chore(security): address the OSS pre-release audit ahead of the jamf org transfer

[Neil Martin (neilmartin83)]

Closes the open items from a §9.2.4 Developer Pre-Release Checklist run against main on 2026-09-12, ahead of the AppSec request to transfer this repository into the jamf GitHub org. terraform-provider-jamfplatform went through the equivalent under ASKAS-447 and moved on 9 or 10 September.

The previous checklist run for this repository dates from 2026-03-16 and predates 646 of the 673 commits now in history. Two of its three follow-ups had never been closed.

Mostly this is a tidy-up. The engineering content of CLAUDE.md and docs/WIRE-FACTS.md is unchanged — both exist to record what the wire does, and every wire fact, figure and date in them still stands. What changes is the incidental detail those records had accumulated: citations to repositories a reader outside Jamf cannot open, and the specific tenants, hosts and fixtures the probes happened to run against. None of it was load-bearing.

SECURITY.md added

OSS Policy §9.1.6 requires it and the repository had none since publication. This is the ESOS template verbatim, the one AppSec substituted into the provider under ASKAS-447. Nothing hand-written: the provider's first attempt was written to Engineering Guidance §2.5(a)-(d) and AppSec replaced it wholesale, including striking a 5-business-day acknowledgement the in-force policy does not state. Starting from the template skips that round trip.

README: Getting help and Troubleshooting

The two items the 2026-03-16 audit left open. Troubleshooting covers the refusals a caller actually hits: the 401 that means "no policy for this API product" as often as "bad credential", the token exchange that 404s on a base URL carrying a path prefix, OWNERSHIP_FORBIDDEN for a crossed-over scope, and the repeated BAD_PERMISSIONS that is a missing gateway route rather than a missing grant.

WithLogger: say that nothing is redacted

The SDK logs nothing until a consumer installs a Logger, so it carries none of the provider's FINDING-1 exposure itself. It does hand over the raw request body, and that body carries ClientSecret, AdminPassword, KeystorePassword and the escaped plist in a configuration profile's Payloads. The interface's contract has to say so, or a naive implementation leaks exactly what the provider's did. Recorded on WithLogger in client.go, the one handwritten file in jamfplatform/, since Logger itself is generated and types.go must not be edited.

The guarantee alongside it is scoped to the half that holds. LogRequest is passed no headers and the OAuth2 token exchange runs on its own http.Client outside the logged path, so neither the bearer token nor the client credential reaches it. LogResponse is a different matter: it receives the response http.Header unfiltered, which is the stated reason the acceptance tracer prints headers from a fixed allowlist rather than filtering them — see docs/STYLE.md and acc_helpers_test.go. The godoc and the README now say both halves, and tell callers to filter in LogResponse, because a guarantee that turns out to be conditional is the reason someone skips filtering.

Non-public Jamf repositories no longer named

The tracked tree named five non-public Jamf repositories 129 times across 22 files: the spec source, the gateway's authorization policy, the service that deploys its bundle, the gateway API definitions and its plugins. It also carried individual policy filenames, the internal directory layout, one verbatim policy rule quoted as a code block, 30 internal pull-request numbers, internal commit SHAs, eight internal Jira keys and a non-production hostname. A reader outside Jamf can open none of it, and AppSec has filed that class of finding before on the grounds that internal repository structure is itself sensitive.

Kept: everything the wire establishes, which is why these documents exist. The registry-versus-allowlist agreement figures, the account privilege pipeline coupling, the two-layer device-groups diagnosis, the validation orderings. A description replaced each citation and every date stayed, which is what keeps the change findable by someone who holds access.

Also kept: Skyway, Wandera and the JSSResource / jssUrl spellings, because Jamf names each of them in a published spec this repository already ships. Nothing under api/ was touched, per the house rule.

Three of the affected files are generated, so the fix went into tools/generate/emit.go and config.go rather than into jamfplatform/permissions.go, proclassic/xml_helpers.go and its test. make generate is at a fixpoint.

Two test-facing phrasings needed care rather than deletion. skywayBlockPinned and prestagePut500 put a Jira key in the failure message so a red lane names the standing fault it pins; both now use a stable descriptive name instead. Guard conditions untouched.

Fixtures and probe records sanitised

The pass above was keyed on repository and ticket citations, which left the other half of the same tidy-up: the tenants, hosts, devices and people the records happened to name. docs/WIRE-FACTS.md accumulates the most of it, because every entry in it is a probe against a real tenant.

Replaced with placeholders: seven organization, environment and tenant UUIDs, a Security Cloud tenant, a UEM connector id, two probe-created group ids, eight gateway trace ids, four tenant and environment names, a Jamf Pro host named after an engineer, two internal service hostnames and one internal commit SHA the first pass missed. Two of those hostnames sat inside a bullet that documents them as a leak.

Nothing is lost by it, because the counts and the dates always carried the evidence and the identifiers never did: <org-a> holds 16 licences and 5 domains whether or not its UUID is printed, and <trace-1> through <trace-3> show three distinct requests exactly as well as the real ids did.

Test fixtures got the same treatment. A user_group fixture captured from a real tenant response named a colleague and three addresses at datajar, since acquired by Jamf; a directory-account fixture was named after another; an LDAP server, a configuration-profile fixture, two device serials, two UDIDs and a MAC address were all real. All synthetic now, on example.invalid where an address is needed, and the fixture named after a person is renamed directoryAccountFixture. Three files carried that one through tools/generate/emit.go, so the template was fixed and the tree regenerated; make generate is a fixpoint again. The comment claiming a list fixture came from a real tenant response is corrected, because it no longer does.

A gitignored local file keeps the map back: all 129 original citations with file and line number, a glossary of each internal source, and a table from every placeholder to the value it replaced.

Secrets

A full-history scan turns up 17 findings over 7 distinct values, and every one is an example rather than a credential: a base64 string in api/pro_api.json that decodes to "This is not a token. Hopefully it looks like a token, but it's not.", an apiClientId documentation UUID, two verificationKey placeholders in api/account_sso_api.json, an AppAndBookTokenId UUID the generator copies out of the spec's example into a godoc comment, a trace-ID literal in a unit test, and one expired Auth0 example JWT whose claims are all documentation placeholders. Five of the seven are in published specs this repository mirrors verbatim and must not edit.

No suppression file ships with that adjudication. GitHub native secret scanning is the org standard and cannot read one, so it would have been inert after the transfer, and writing one means copying seven secret-shaped literals into a second tracked file — worth avoiding in a repository about to be public, harmless though these particular values are. The write-up goes to the reviewers who need it instead.

Secret scanning, push protection, AI detection, non-provider patterns and validity checks are all enabled here and report no open alerts. TruffleHog reports 0 verified findings.

Verification

go build, go vet, go vet -tags acceptance, the full unit suite, the generator's own tests, gofmt, copywrite headers --plan and a make generate drift check: all clean.

🤖 Generated with Claude Code