guidewire-security-basics

# Guidewire Security Basics ## Overview Guidewire manages insurance policy administration, claims processing, and billing containing policyholder PII (SSNs, driver's license numbers, medical records for claims), financial settlement data, and adjuster notes. A breach exposes claimant personal information, policy terms, and payment histories across the entire insurance book of business. Secure OAuth2 JWT tokens, Cloud API roles, Gosu custom code, and any integration touching policy or claims data. ## API Key Management ```typescript function createGuidewireClient(): { token: string; baseUrl: string } { const clientId = process.env.GUIDEWIRE_CLIENT_ID; const clientSecret = process.env.GUIDEWIRE_CLIENT_SECRET; const tokenUrl = process.env.GUIDEWIRE_TOKEN_URL; if (!clientId || !clientSecret || !tokenUrl) { throw new Error("Missing GUIDEWIRE_CLIENT_ID, CLIENT_SECRET, or TOKEN_URL"); } // OAuth2 tokens are short-lived JWTs — never cache beyond expiry console.log("Guidewire OAuth2 client initialized for:", tokenUrl); return { token: "", baseUrl: process.env.GUIDEWIRE_API_URL! }; } ``` ## Webhook Signature Verification ```typescript import crypto from "crypto"; import { Request, Response, NextFunction } from "express"; function verifyGuidewireWebhook(req: Request, res: Response, next: NextFunction): void { const signature = req.headers["x-guidewire-signature"] as string; const secret = process.env.GUIDEWIRE_WEBHOOK_SECRET!; const expected = crypto.create...