Spec Kitty

└─ kitty-specs
   └─ Org Init Template Security Remediation

Mission Run:

📚 Docs ↗

Contracts

credential-injection.md

Contract: Template-path credential injection

Policy

When resolving a doctrine org init --template git location, Spec Kitty MUST NOT embed GIT_TOKEN into the HTTPS URL.

Mechanism

GitSource(..., inject_token=False) (default remains True for other callers).

Documentation

Operator docs MUST state that --template HTTPS clones are unauthenticated via GIT_TOKEN; use SSH remotes for private templates.

path-token-rejection.md

Contract: Path-token rejection

Tokens

{{ORG_NAME}} and {{LOCAL_PATH}} only.

Continue to substitute in UTF-8 text file contents; fail if leftovers remain (substitute.leftover_tokens).

Entry names

If any file or directory name (any path component under the staging/PACK tree) contains either token literally, fail with substitute.path_token and do not install a successful pack.

Non-goals

No automatic renaming / path substitution engine.