[Security Audit] Security hardening for plugin-cloudquery

[fdelbrayelle]

Summary

Security audit of plugin-cloudquery against OWASP Top 10 (2025), CWE Top 25, OWASP ASVS Level 1, Kestra Plugin-Specific Threats (KPS), and Supply Chain Dependency Hygiene.

Audit date: 2026-06-30
Auditor: AI-assisted scan (kestra-plugin-security-auditing skill)

Findings Overview

CRITICAL (tracked as sub-issues)

None

HIGH (tracked as sub-issues)

• Credential env map included in Lombok @tostring output — src/main/java/io/kestra/plugin/cloudquery/AbstractCloudQueryCommand.java:31

MEDIUM (no sub-issue — remediate during next sprint)

None

LOW (no sub-issue — address opportunistically)

None

Acceptance Criteria

• All CRITICAL sub-issues resolved and merged
• All HIGH sub-issues resolved and merged
• MEDIUM/LOW findings triaged: accepted, deferred with rationale, or fixed
• Follow-up scan scheduled within 90 days

Standards

• OWASP Top 10 (2025)
• CWE Top 25
• OWASP ASVS
• Kestra Plugin-Specific Threats (KPS-01 to KPS-09)
• SLSA Supply Chain Security

---

View full audit report as Artifact

[fdelbrayelle]

Closing — security fix PR #171 merged.