Skip to content

Security: IranUdesha/azure-devops-automation-toolkit

Security

SECURITY.md

πŸ” Security Setup Guide

Before Using This Tool

  1. Create your local configuration file (this will be ignored by git):

    cp src/config.py src/config_local.py
  2. Update src/config_local.py with your actual values:

    AZURE_CONFIG = {
        "organization": "your-actual-organization",
        "project": "your-actual-project", 
        "pat": "your-actual-personal-access-token"
    }
  3. Alternative: Use environment variables:

    # Windows PowerShell
    $env:AZURE_ORGANIZATION = "your-organization"
    $env:AZURE_PROJECT = "your-project"
    $env:AZURE_PAT = "your-personal-access-token"
    
    # Linux/Mac
    export AZURE_ORGANIZATION="your-organization"
    export AZURE_PROJECT="your-project"
    export AZURE_PAT="your-personal-access-token"
  4. Update main.py to use your local config:

    # Option 1: Use local config file
    import config_local as config
    
    # Option 2: Use environment variables
    config_manager = get_config_manager(use_env_vars=True)

🚨 Security Checklist

βœ… Files Secured:

  • config.py - Contains placeholder values only
  • .env.example - Contains placeholder values only
  • README.md - No real credentials in examples
  • .gitignore - Prevents committing sensitive files

⚠️ Important Notes:

  • NEVER commit real credentials to version control
  • ALWAYS use local config files or environment variables for real values
  • VERIFY .gitignore is working before first commit
  • ROTATE your PAT if it was previously committed

πŸ”‘ Personal Access Token (PAT) Permissions Required:

  • Code (Read & Write) - For repository and branch operations
  • Project and Team (Read) - For listing repositories

πŸ“‹ Pre-Commit Verification

Run this command to verify no secrets are in your files:

# Check for potential secrets
grep -r "ELi6rSv\|peopleshr\|hBiz-DevOps" . --exclude-dir=.git

If this returns any results, DO NOT COMMIT until they are replaced with placeholders.

πŸ”„ First Time Setup After Clone

  1. Copy example config: cp src/config.py src/config_local.py
  2. Edit src/config_local.py with your real values
  3. Test the application: cd src && python main.py
  4. Verify it works before making any changes

There aren't any published security advisories