hubspot-policy-guardrails

# HubSpot Policy & Guardrails ## Overview Automated policy enforcement for HubSpot integrations: secret scanning, ESLint rules, CI checks for token leaks, and runtime guardrails. ## Prerequisites - ESLint configured in project - CI/CD pipeline (GitHub Actions) - TypeScript for compile-time enforcement ## Instructions ### Step 1: Secret Scanning (Prevent Token Leaks) ```yaml # .github/workflows/hubspot-security.yml name: HubSpot Security Scan on: [push, pull_request] jobs: secret-scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Scan for HubSpot private app tokens run: | # Pattern: pat-{region}{number}-{uuid} if grep -rE "pat-[a-z]{2}[0-9]-[a-f0-9-]{36}" \ --include="*.ts" --include="*.js" --include="*.json" --include="*.yaml" \ --exclude-dir=node_modules --exclude-dir=.git .; then echo "::error::HubSpot private app token found in source code!" echo "Rotate this token immediately in HubSpot Settings > Private Apps" exit 1 fi - name: Scan for deprecated API keys run: | # Pattern: hapikey=uuid if grep -rE "hapikey=[a-f0-9-]{36}" \ --include="*.ts" --include="*.js" --include="*.env.example" \ --exclude-dir=node_modules .; then echo "::error::Deprecated HubSpot API key found! Migrate to private app tokens." exit 1 fi - name: Verify .g...