20 lines
727 B
Plaintext
20 lines
727 B
Plaintext
---
|
|
description: Secure storage and secret handling
|
|
globs: **/*Secret*, **/*Store*, **/secure/**, **/*Credential*, **/*Config*
|
|
alwaysApply: false
|
|
---
|
|
|
|
# Secure storage
|
|
|
|
Full spec: @AGENTS.md §7.5.
|
|
|
|
- Stores Wi-Fi SSID/password, user credentials, station list. Encrypted
|
|
at rest (NVS encryption on an encrypted partition, or a device key in
|
|
eFuse). Confirm the mechanism against current ESP-IDF security docs
|
|
before implementing.
|
|
- A `Secret` wrapper: no operator<<, no implicit conversion to a loggable
|
|
string, buffer zeroised on destruction.
|
|
- Secrets are never logged, never placed in URLs, never serialised to
|
|
plaintext. Access goes through `ISecureStore` so core and tests never
|
|
touch real flash or real keys.
|