secvault 3.1.0 → 3.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d57e110e287dd498f1751e5d823283c7f673c5f7511fca743772bec1ba25c5fc
-  data.tar.gz: b4c48354b471bc32634eb40dc15a99869e86825aae010f9f338ca4ab91850d66
+  metadata.gz: ff511b4da4c277844438956507222da90bd15416fd8e4adec1e973a4e5b73993
+  data.tar.gz: 45219a2e917ac366af2c94c8a848cc5557219b4856daab6fcd870d19898d1685
 SHA512:
-  metadata.gz: 6c1f2e1f452cfca7bbcc34117a32b05d252589d156b59175158577548f9158628bf1d0f01ace21714b3f8cf7fd8de195769ecf0d60b6d11915d4ca10163070e3
-  data.tar.gz: 1b5ffc0246423e154b2c0e12799e6d11370c8fa242eed3bec9f902e98df9119e70d0ae1da27f02c206a62a47b839c8e0788f35afd0d5a5cca7fe360739c66ced
+  metadata.gz: 45e5d96b9eaa32ea9396921451dfb2ed148e485992236ae45bf58acf9a380869cde8df8b3e93e621cdfe1bcd9710f4eccbeaee3880fa5436c73e336d063d866f
+  data.tar.gz: db91a660ae62430a0c27f311bd512d964efc485f4a224e42f958b9215d31c9c553db765b638b622413b18c9b236ab6865d14328594f8d6ab726452484eddc767

data/README.md

@@ -3,6 +3,7 @@
 Simple YAML secrets management for Rails. Uses standard YAML anchors for sharing configuration.
 
 [![Gem Version](https://img.shields.io/gem/v/secvault.svg)](https://rubygems.org/gems/secvault)
+[![CI](https://github.com/unnitallman/secvault/actions/workflows/ci.yml/badge.svg)](https://github.com/unnitallman/secvault/actions/workflows/ci.yml)
 
 ## Installation
 

data/SECURITY.md

@@ -0,0 +1,98 @@
+# Security Policy
+
+## Supported Versions
+
+We actively support the following versions of Secvault with security updates:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 3.1.x   | :white_check_mark: |
+| 3.0.x   | :white_check_mark: |
+| < 3.0   | :x:                |
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+Instead, please report security vulnerabilities by emailing **unnikrishnan.kp@bigbinary.com**.
+
+You should receive a response within 48 hours. If the issue is confirmed, we will release a patch as soon as possible depending on complexity but typically within 7 days.
+
+### What to Include in Your Report
+
+Please include the following information in your vulnerability report:
+
+- Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
+- Full paths of source file(s) related to the manifestation of the issue
+- The location of the affected source code (tag/branch/commit or direct URL)
+- Any special configuration required to reproduce the issue
+- Step-by-step instructions to reproduce the issue
+- Proof-of-concept or exploit code (if possible)
+- Impact of the issue, including how an attacker might exploit the issue
+
+This information will help us triage your report more quickly.
+
+## Security Best Practices
+
+When using Secvault in your applications, please follow these security best practices:
+
+### 1. File Permissions
+- Ensure your secrets files (`config/secrets.yml`, etc.) have restrictive file permissions (600 or 640)
+- Never commit secrets files to version control
+- Use `.gitignore` to exclude secrets files from your repository
+
+### 2. Environment Separation
+- Use different secrets files for different environments (development, staging, production)
+- Never use production secrets in development or testing environments
+- Implement proper environment-specific configuration
+
+### 3. Secret Management
+- Rotate secrets regularly
+- Use strong, randomly generated secrets
+- Avoid hardcoding secrets in application code
+- Consider using external secret management services for production environments
+
+### 4. Access Control
+- Limit access to secrets files to only necessary personnel and processes
+- Use proper deployment practices that don't expose secrets in logs or process lists
+- Implement proper access controls in your deployment infrastructure
+
+### 5. Monitoring and Auditing
+- Monitor access to secrets files
+- Implement logging for secrets access (without logging the actual secret values)
+- Regular security audits of your secrets management practices
+
+## Dependencies and Supply Chain Security
+
+Secvault has minimal dependencies to reduce attack surface:
+
+- **Rails**: We require Rails >= 7.1.0 and stay updated with security patches
+- **Zeitwerk**: Used for autoloading, maintained by the Rails core team
+
+We regularly monitor our dependencies for security vulnerabilities and update them promptly when security issues are discovered.
+
+## Security Considerations
+
+### Hot Reload Feature
+The hot reload feature (`reload_secrets!`) is designed for development environments only. It should not be enabled in production as it can potentially expose secrets through memory dumps or debugging tools.
+
+### Rails Integration
+Secvault integrates deeply with Rails' secrets system. While this provides seamless functionality, it's important to understand that secrets are loaded into memory and may be visible to processes with sufficient privileges.
+
+### File System Security
+Secvault reads secrets from the file system. Ensure your deployment environment has proper file system security controls in place.
+
+## Acknowledgments
+
+We appreciate the security research community and responsible disclosure. Contributors who report valid security vulnerabilities will be acknowledged in our release notes (unless they prefer to remain anonymous).
+
+## Contact
+
+For any security-related questions or concerns, please contact:
+
+**Email**: unnikrishnan.kp@bigbinary.com  
+**Project**: https://github.com/unnitallman/secvault
+
+---
+
+*This security policy is effective as of the date of the latest commit to this file and applies to all current and future versions of Secvault.*

data/lib/secvault/secrets.rb

@@ -66,9 +66,9 @@ module Secvault
           # Read and process the plain YAML file content
           source = path.read
 
-          # Process ERB and parse YAML
+          # Process ERB and parse YAML - using same method as Rails
           erb_result = ERB.new(source).result
-          secrets = YAML.safe_load(erb_result, aliases: true, permitted_classes: [])
+          secrets = YAML.respond_to?(:unsafe_load) ? YAML.unsafe_load(erb_result) : YAML.load(erb_result)
 
           secrets ||= {}
 
@@ -79,8 +79,9 @@ module Secvault
 
       def read_secrets(secrets_path, env)
         if secrets_path.exist?
-          # Handle plain YAML secrets.yml only
-          all_secrets = YAML.safe_load(ERB.new(secrets_path.read).result, aliases: true)
+          # Handle plain YAML secrets.yml only - using same method as Rails
+          erb_result = ERB.new(secrets_path.read).result
+          all_secrets = YAML.respond_to?(:unsafe_load) ? YAML.unsafe_load(erb_result) : YAML.load(erb_result)
 
           env_secrets = all_secrets[env.to_s]
           return env_secrets.deep_symbolize_keys if env_secrets

data/lib/secvault/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Secvault
-  VERSION = "3.1.0"
+  VERSION = "3.2.0"
 end

data/lib/secvault.rb

@@ -267,9 +267,6 @@ module Secvault
 
     Rails.logger&.info "[Secvault] Hot reload enabled. Use reload_secrets! to refresh secrets." unless defined?(Rails) && Rails.env.respond_to?(:production?) && Rails.env.production?
   end
-
-  public
-
 end
 
 # Auto-install and setup when Rails is available

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secvault
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.2.0
 platform: ruby
 authors:
 - Unnikrishnan KP
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-09-23 00:00:00.000000000 Z
+date: 2025-09-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -38,6 +38,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.6'
+- !ruby/object:Gem::Dependency
+  name: rspec_junit_formatter
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.6'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.6'
 description: Secvault restores the classic Rails secrets.yml functionality that was
   removed in Rails 7.2, using simple, plain YAML files for environment-specific secrets
   management. Compatible with Rails 7.1+, 7.2+ and 8.0+.
@@ -52,6 +66,7 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- SECURITY.md
 - lib/secvault.rb
 - lib/secvault/rails_secrets.rb
 - lib/secvault/railtie.rb
@@ -73,7 +88,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.0.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="