Security

Operator integration touches credentials and money movement. Treat it as production payment-adjacent surface.

Secret storage

• store API keys in secret manager only
• store webhook secret separately from wallet adapter auth secret
• rotate secrets on leak suspicion, not only on schedule
• never embed secrets in browser code

Least privilege

• prefer narrow API keys by workload
• avoid * unless operationally justified
• restrict who can view or rotate production secrets
• use staff login for dashboard operations; machine API keys, even with *, cannot access staff-only support or market requests
• grant all required reporting scopes explicitly; Market PnL and Cash Flow Triage use compound permissions, not a new all-purpose finance scope
• do not assume hiding a dashboard menu changes API authorization or creates private-market ownership

Transport security

• use HTTPS for webhook endpoints outside localhost testing
• use TLS for operator wallet adapter host
• terminate TLS only on trusted infrastructure

Replay protection

• verify X-Polynion-Signature
• reject unsupported signature version
• reject timestamp skew greater than 5 minutes
• dedupe on event_id
• compute HMAC over the exact received raw bytes, before JSON parsing or reserialization
• persist accepted events durably before returning 2xx; acknowledge duplicates without repeating side effects
• replay/resend signs a new attempt for an existing event; a fresh delivery timestamp does not make that event new

Wallet mutation safety

• every debit and credit must be idempotent
• every ambiguous result must be traceable by the original idempotency key in operator wallet logs
• never replay money mutation only because network timed out
• persist the original user, direction, currency, amount, key, and result atomically with the wallet ledger effect
• reject conflicting reuse of a key; a timeout or contradictory echoed response is not authorization for a second effect
• accept zero only for the documented Polyflight loss acknowledgement, not for generic monetary operations

Logging rules

• log IDs, not secrets
• redact bearer tokens and webhook secrets
• store UTC timestamps
• keep enough logs to trace idempotency_key and event_id
• treat support conversations and CSV exports as sensitive operator data; share only the minimum affected-user evidence
• preserve original signed bytes in restricted operator logs if needed for incident analysis; dashboard previews and redacted evidence are not raw-signature proof