adobe-policy-guardrails

# Adobe Policy & Guardrails ## Overview Automated policy enforcement for Adobe integrations: credential pattern scanning (Adobe OAuth secrets use `p8_` prefix), Firefly content policy pre-screening, PDF Services quota guardrails, and OAuth scope validation. ## Prerequisites - ESLint configured in project - CI/CD pipeline (GitHub Actions) - Understanding of Adobe credential patterns ## Instructions ### Guardrail 1: Adobe Credential Pattern Scanner Adobe OAuth Server-to-Server secrets follow the `p8_` prefix pattern: ```yaml # .github/workflows/adobe-security.yml name: Adobe Security Scan on: [push, pull_request] jobs: credential-scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Scan for Adobe credential patterns run: | EXIT_CODE=0 # Adobe OAuth client secrets (p8_ prefix) if grep -rE "p8_[A-Za-z0-9_-]{20,}" --include="*.ts" --include="*.js" --include="*.py" --include="*.json" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v node_modules | grep -v '.git'; then echo "::error::Adobe client_secret pattern (p8_) found in source code" EXIT_CODE=1 fi # Adobe IMS access tokens (JWT format) if grep -rE "eyJ[A-Za-z0-9_-]{100,}\.[A-Za-z0-9_-]{100,}" --include="*.ts" --include="*.js" . 2>/dev/null | grep -v node_modules | grep -v '.git' | grep -v '\.test\.' | grep -v '__mock'; then echo "::warning::Potential Adobe access ...