Export Hardening Guide

Status: Draft (2025-11-26) · DOCS-EXPORT-37-004

This guide hardens the data-export surfaces of the Stella Ops release control plane — Export Center, Graph exports, and SBOM exports — so that nothing leaves a tenant boundary without cryptographic integrity and explicit tenant proof. It is written for operators configuring export RBAC and for engineers building or reviewing export endpoints, in both online and air-gapped deployments.

See also: secrets-handling.md for secret-material lifecycle, crypto-compliance.md for regional crypto profiles, and OFFLINE_KIT.md for tamper-evident offline artefacts.

Scope

Protect export flows (Export Center, Graph exports, SBOM exports) in online and air-gapped deployments.

RBAC & tenancy

• Enforce export:* scopes per service:
  • Graph: graph:export
  • Export Center: export.viewer, export.operator, export.admin
  • SBOM: sbom:export
• Require X-StellaOps-TenantId on every export request; deny if missing/mismatched.
• Default deny cross-tenant access even for admins.

Encryption & integrity

• All exports must include SHA256 (and size) headers; prefer DSSE manifest for multi-file bundles.
• When storing or staging bundles, encrypt at rest (KMS or sealed disk); in air-gap, keep CMK/KEK offline-ready.
• For downloadable endpoints, set X-Content-SHA256; clients must verify hash before use.

Redaction & minimization

• Default exclude secrets, tokens, and credentials from exports; add allowlist only when required.
• For policy/VEX overlays, strip explain traces unless explicitly requested.
• Include only tenant-scoped data; avoid global caches in exported bundles.

Network & paths

• Disallow direct external URLs in exports; use content-addressed blobs or gateway download paths.
• In air-gap mode, block egress during export and rely on local object storage.
• Set Content-Security-Policy: sandbox for HTML/PNG exports where applicable.

Imposed rule reminder

• Follow the platform “imposed rule” banner: No external distribution without cryptographic integrity + tenant proof.
• Every export must be reproducible: document source snapshot IDs, overlay versions, tool version, and hash.

Runbook (abridged)

• If hash mismatch: stop distribution, regenerate export, open incident with bundle hash and source snapshot IDs.
• If RBAC failure spike: check gateway policy and scope mappings; verify tenant header presence in clients.
• Air-gap: verify bundle catalog signatures before ingest; reject if trust root mismatches.