Security-And-Access - blame

Blame

e23584	Dan Alexander	2026-09-14 10:46:55
Add company wiki standards and VoxelCore docs This change establishes the shared company knowledge structure, governance, engineering, security, and incident/change standards. It also adds the VoxelHorizons product tree with a complete VoxelCore documentation set covering architecture, operations, authoring, version support, resource pack compilation, runtime reloads, and testing/release workflows.

# Security and Access

The wiki should describe **how** to obtain or rotate access, never store the secret itself.

## Never commit

Do not place these in wiki Markdown, attachments or repository history:

- passwords;

- API tokens and personal access tokens;

- OAuth/OIDC client secrets;

- private keys or recovery codes;

- database connection strings containing credentials;

- session cookies;

- private customer or employee data that does not belong in the documentation repository.

## Document instead

Record the system name, purpose of the credential, where it is managed, who/which role is expected to have access, rotation expectations, and the recovery/escalation procedure.

## Least privilege

Service and human access should be scoped to the minimum permissions required. Administrative credentials should not be reused as application credentials.

## Incident handling

If a secret is accidentally committed, deleting the page is insufficient because Git history may retain it. Rotate/revoke the secret first, then remove it from current content and rewrite repository history only when appropriate. Record the event using [[Templates/Incident-Review]] without reproducing the exposed secret.