adam/procurement-ingest
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/procurement-ingest.git synced 2026-10-01 11:13:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
procurement-ingest/lambdas/wo/email_processor
History
Adam Moussa f175323939 Validate sender and require Secrets Manager key 
The PO and WO email processors acted on email from any sender — the
public addresses (amazon_po@, apm@) accept mail from anyone, so an
attacker could forge POs/WOs. Reject email whose verified sender
domain is not on a configurable allowlist (ALLOWED_SENDER_DOMAINS),
and drop messages with an explicit SES SPF/DKIM/spam/virus failure.

Also remove the silent fallback to a plaintext ANTHROPIC_API_KEY env
var; require ANTHROPIC_API_KEY_SECRET_ARN and raise if absent so a
misconfigured deploy fails loudly instead of using an unmanaged key.
2026-06-17 11:37:29 -04:00
..
__init__.py Merge workorder-ingest into unified procurement repo (#22) 2026-05-12 15:21:06 -04:00
handler.py Validate sender and require Secrets Manager key 2026-06-17 11:37:29 -04:00
requirements.txt Update boto3 requirement in /lambdas/wo/email_processor (#67) 2026-06-16 21:16:19 +00:00