Redaction Defaults Decision

Decision ID: DECISION-SECURITY-001 Status: Approved (default) Effective Date: 2025-12-06 Owner: Security Guild

This decision record fixes the default redaction posture for Stella Ops notification and export pipelines. It is the reference for engineers wiring redaction into a notifier or exporter, and for operators choosing a tenant redaction level. The concrete field-by-field redaction behaviour for the Notify module is catalogued in the Notify redaction and PII catalog.

Decision

Notification and export pipelines use restrictive redaction defaults that redact PII, secrets, and cryptographic keys. Operators may relax this per tenant via configuration; the secure posture is the out-of-the-box default.

Rationale

1. Security-first approach minimizes data exposure risk
2. Users can opt-in to less restrictive settings via configuration
3. Aligns with GDPR and data minimization principles
4. Consistent with existing Evidence Locker redaction patterns

Default Redaction Rules

Always Redacted (HIGH)

• Private keys (RSA, ECDSA, Ed25519)
• API keys and tokens
• Passwords and secrets
• Database connection strings
• JWT tokens

Redacted by Default (MEDIUM) - Opt-out available

• Email addresses
• IP addresses (external)
• File paths containing usernames
• Environment variable values (not names)

Not Redacted (LOW)

• Package names and versions
• CVE identifiers
• Severity scores
• Public key fingerprints

Configuration

# etc/notify.yaml
redaction:
  level: restrictive  # Options: permissive, standard, restrictive
  custom_patterns:
    - pattern: "INTERNAL_.*"
      action: redact

Impact

• Unblocks the notification and export redaction work tracked under the SPRINT_0170 notifications stream (see References).

Reversibility

To change redaction defaults:

1. Update the Notify redaction and PII catalog.
2. Get Security Guild sign-off.
3. Update configuration schemas.
4. Ensure backward compatibility.

References

• Notify redaction and PII catalog
• SPRINT_0170 Notifications