palantir-security-basics

# Palantir Security Basics ## Overview Security best practices for Foundry API tokens, OAuth2 credentials, scope management, and secret rotation. Covers both personal access tokens (dev) and service user credentials (production). ## Prerequisites - Foundry Developer Console access - Understanding of OAuth2 scopes ## Instructions ### Step 1: Secure Credential Storage ```bash # .env — NEVER commit to git FOUNDRY_HOSTNAME=mycompany.palantirfoundry.com FOUNDRY_CLIENT_ID=your-client-id FOUNDRY_CLIENT_SECRET=your-client-secret # .gitignore — ensure .env files are excluded echo '.env' >> .gitignore echo '.env.local' >> .gitignore echo '.env.*.local' >> .gitignore ``` For production, use a secrets manager: ```bash # AWS Secrets Manager aws secretsmanager create-secret --name foundry/prod \ --secret-string '{"client_id":"xxx","client_secret":"yyy","hostname":"zzz"}' # Google Cloud Secret Manager echo -n "your-client-secret" | gcloud secrets create foundry-client-secret --data-file=- # HashiCorp Vault vault kv put secret/foundry client_id=xxx client_secret=yyy ``` ### Step 2: Apply Least Privilege Scopes | Environment | Recommended Scopes | Rationale | |-------------|-------------------|-----------| | Development | `api:read-data` | Read-only prevents accidental mutations | | Staging | `api:read-data`, `api:write-data` | Test writes in safe environment | | Production | Only scopes your app actually needs | Minimize blast radius | ```python # Production app that only reads O...