fix: avoid persisting borrowed credential secrets (#31416)

2026-05-25 00:32:08 -07:00
parent 2b768535c9
commit d7c5d5dee5
6 changed files with 590 additions and 27 deletions
@@ -36,7 +36,9 @@ def get_secret_source(env_var: str) -> str | None:
    Returns ``"bitwarden"`` for keys pulled from Bitwarden Secrets Manager
    during the current process's ``load_hermes_dotenv()`` call.  Returns
    ``None`` for keys that came from ``.env``, the shell environment, or
-    aren't tracked.
+    aren't tracked.  The returned label is metadata only: credential-pool
+    persistence may store it to explain the origin of a borrowed secret, but
+    must never treat it as authorization to persist the raw value.
    """
    return _SECRET_SOURCES.get(env_var)