lokalise-security-basics

# Lokalise Security Basics ## Overview Security practices for Lokalise integrations: API token management with scoped permissions, translation content sanitization, CI/CD secret handling, webhook secret verification, and audit logging. Lokalise handles translation strings that may contain user-facing content, interpolation variables, and occasionally PII embedded in keys or values. ## Prerequisites - Lokalise API token provisioned (admin token for audit, scoped tokens for operations) - Understanding of Lokalise token permission model (read-only vs read-write) - Secret management infrastructure (GitHub Secrets, AWS Secrets Manager, GCP Secret Manager, or Vault) ## Instructions ### Step 1: Token Scope Management Lokalise API tokens are either read-only or read-write. Create separate tokens per use case to enforce least privilege. ```typescript import { LokaliseApi } from "@lokalise/node-api"; // Token strategy: separate tokens per context const TOKENS = { // CI download pipeline — read-only token ciDownload: process.env.LOKALISE_READ_TOKEN, // CI upload pipeline — read-write token ciUpload: process.env.LOKALISE_WRITE_TOKEN, // Admin operations (contributor management, webhooks) — admin token admin: process.env.LOKALISE_ADMIN_TOKEN, } as const; function getClient(scope: keyof typeof TOKENS): LokaliseApi { const token = TOKENS[scope]; if (!token) { throw new Error( `LOKALISE_${scope.toUpperCase()}_TOKEN not set. ` + `Generate at https://app...