adam/procurement-ingest
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/procurement-ingest.git synced 2026-10-01 20:33:11 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
procurement-ingest/lambdas/po
History
Adam Moussa f175323939 Validate sender and require Secrets Manager key 
The PO and WO email processors acted on email from any sender — the
public addresses (amazon_po@, apm@) accept mail from anyone, so an
attacker could forge POs/WOs. Reject email whose verified sender
domain is not on a configurable allowlist (ALLOWED_SENDER_DOMAINS),
and drop messages with an explicit SES SPF/DKIM/spam/virus failure.

Also remove the silent fallback to a plaintext ANTHROPIC_API_KEY env
var; require ANTHROPIC_API_KEY_SECRET_ARN and raise if absent so a
misconfigured deploy fails loudly instead of using an unmanaged key.
2026-06-17 11:37:29 -04:00
..
email_processor Validate sender and require Secrets Manager key 2026-06-17 11:37:29 -04:00
site_extractor Merge workorder-ingest into unified procurement repo (#22) 2026-05-12 15:21:06 -04:00
web_ui Merge workorder-ingest into unified procurement repo (#22) 2026-05-12 15:21:06 -04:00