Encrypt sensitive credential fields before event bus emission (#215)

- Add encrypt_credential_dict() and decrypt_credential_field() to utils/crypto.py
- Create utils/credential_encryption.py with encryption/decryption helpers
- Add get_credential_encryption_key() to retrieve key from Infisical at runtime
- Add emit_credential_found() wrapper for modules to use instead of direct bus.emit()
- Update all 15 modules emitting CREDENTIAL_FOUND to use encrypted wrapper
- Update 4 modules consuming CREDENTIAL_FOUND to decrypt payload before processing
- Sensitive fields (username, password, hash, token, etc.) encrypted with AES-256-GCM
- Falls back to plaintext if encryption key unavailable or encryption fails

This commit is contained in:

Cobra

2026-04-06 11:43:46 -04:00

parent f15b8994cd

commit edf2ea7c36

18 changed files with 256 additions and 63 deletions

.gitignore

View File

@@ -10,3 +10,4 @@ __pycache__/
 *.pcap.zst
 *.pcap.zst.enc
 net_alerter/.secrets
 BIGBROTHER_DESIGN.md