Skip to content

Repository navigation

Security: rbarok/management-helper

Security

SECURITY.md

Security Policy

Project: Manager Helper

This document describes how to report vulnerabilities and the security controls for this application. It applies to code under src/, frontend/, platform/, and resources/ in this repository.

Reference: MITRE ATLAS for AI/agent threat modeling.

Supported versions

Version Supported Notes
0.1.x Yes Current dev / v1 line
pre-0.1 No Pre-release snapshots

Security fixes are applied on main. Deploy from tagged releases when available.

Reporting a vulnerability

Do not open public GitHub issues for exploitable security bugs.

Scope Contact
This application (auth bypass, perspective leakage, injection in app code) Open a private security advisory with the repository maintainer, or contact your organization's security team if this is an internal fork
Databricks platform (workspace, Lakebase, Apps runtime, Model Serving) bugbounty@databricks.com

Include: affected route or component, reproduction steps, impact, and suggested fix if known.

We aim to acknowledge reports within 5 business days.

Security model

Trust boundaries

Asset Classification Boundary
perspective_*_messages (Lakebase) Confidential Backend + app service identity only; never cross-exposed between perspectives
cases, resolves (Lakebase) Confidential / internal Manager Resolve view; other stakeholders do not see raw peer messages in v1
LangGraph state & prompts Confidential Server-side only; LLM on manager Discuss trigger
MLflow experiment (notebook job) Internal Manager Run sync only — never in employee chat path
User chat input Confidential / untrusted Treat as prompt-injection vector
CLI profiles (~/.databrickscfg) Restricted Host machine only; never committed

v1 isolation rule

Each stakeholder UI may read/write only its perspective API routes and Lakebase table. The backend must not expose one perspective's messages to another stakeholder UI.

Advisory disclaimer

Resolve output is managerial guidance — not authoritative HR or legal judgment. The manager UI must display this disclaimer.

Authentication and authorization

  • Identity: Databricks Apps forwarded header x-forwarded-email only (src/app/app/auth.py).
  • Never trust client-supplied JSON fields (email, role, user id) for authorization.
  • Manager routes: allowlist from MANAGER_EMAILS env (comma-separated). Routes fail closed when unset or when principal is not listed.
  • Local dev only: ALLOW_DEV_ANONYMOUS=true — never enable in deployed apps.

Secrets and configuration

Must

  • Store secrets in Databricks secret scopes or platform-injected app env — not repo files.
  • Use CLI OAuth profile auth locally: DATABRICKS_CONFIG_PROFILE=DEFAULT + databricks auth login.
  • Set MANAGER_EMAILS in the workspace app UI after deploy — not in committed app.yaml.
  • Use databricks.local.yml (gitignored) for workspace-specific bundle overrides.
  • Redact tokens, PATs, connection strings, and chat PII from logs where policy requires.

Must not

  • Commit DATABRICKS_TOKEN, PATs, service-principal keys, or .env with real credentials.
  • Commit absolute machine paths or personal emails in bundle or app config.
  • Enable USE_IN_MEMORY_DB, USE_MOCK_LLM, USE_MOCK_JOB_RUNNER, or ALLOW_DEV_ANONYMOUS in deployed apps.
  • Write to production catalogs or Lakebase from dev tasks without explicit approval and review.

AI and LLM controls

Control Implementation
LLM scope system.ai.meta-llama-3-3-70b-instruct on manager Discuss only — not per chat message
Agent location LangGraph runs server-side only — no client-side agent logic
Prompt injection (AML.T0051) Sanitize user content; separate system vs user messages; treat chat as untrusted
Tool abuse (AML.T0053) No arbitrary tool/MCP invocation in production app path
Observability split Chat POST → Lakebase only (fast path). MLflow via manager-click notebook job (async)
Resolve gate Manager must approve before Resolve is official (approval_status)

Deployment security

Environment UC catalog (default) Lakebase (default) Deploy
dev dev_catalog.manager manager_dev databricks bundle deploy -t dev
staging Task-defined Task-defined Requires named task + review
prod Task-defined Task-defined Security review + explicit task only

Post-deploy checklist:

  • MANAGER_EMAILS set in app UI
  • LAKEBASE_ENDPOINT bound via bundle postgres resource
  • Mock/dev flags absent from app env
  • MLflow sync job has no cron schedule (manager click only)
  • /health returns ok

Full runbook: platform/deploy/dev.md

Data handling

Object Default classification
Perspective chat messages Confidential
Case/session metadata Internal
Resolve artifacts Internal
MLflow dataset rows Internal — limit/redact PII per policy
App logs Internal — no secrets or full message dumps

Frontend renders user content through DOMPurify before display.

Incident response

  1. Secret committed: Rotate immediately, revoke old credential, force-push only with maintainer approval.
  2. Perspective isolation breach: Stop deployment, audit API routes and SQL, preserve logs, escalate.
  3. Unauthorized manager access: Verify MANAGER_EMAILS, review forwarded identity headers, redeploy if env tampered.
  4. UC/Lakebase over-privilege: Revoke excess grants, audit query history, re-apply least privilege.

Pre-merge checklist (contributors)

  • No secrets in diff (git diff — no tokens, PATs, real emails)
  • Auth still uses platform headers only; manager allowlist unchanged appropriately
  • No cross-perspective API or query leakage introduced
  • No MLflow SDK calls added to chat POST handlers
  • LangGraph changes reviewed for prompt-injection controls
  • Deploy docs updated if env or bundle contract changes

Related documentation

There aren't any published security advisories