Apply strict trust boundaries to authentication/credential state:
- Reset per-request sensitive fields on reuse (especially pooled request/contexts). Never let prior request overrides (keys, base URLs, auth headers) bleed into later requests.
- Write-protect security-critical context keys. Treat reserved/internal keys as framework-owned: plugins should not be able to set them via public setters. Use an internal-only bypass for framework methods.
- Never persist redacted/masked placeholders as real secrets. If an update payload contains a “masked preview” (redacted non-secret), require a non-empty stored counterpart; otherwise fail validation (400) instead of storing the placeholder.
- Validate outbound targets that depend on credentials/config to prevent SSRF (e.g., enforce HTTPS + allowlisted host patterns; validate again at dial time, not only at create time).
Example (masked placeholder preservation rule):
// incoming may be a UI placeholder like "****"; treat it as non-secret.
if incomingVal.IsRedacted() && !incomingVal.IsFromSecret() {
if storedVal == nil || !storedVal.IsSet() {
return fmt.Errorf("masked preview requires stored value") // reject
}
incomingVal = *storedVal // preserve real secret
}
Also ensure pooled objects are cleaned:
// before putting request back into a pool or before reusing it
req.ProviderOverride = nil // clear per-request overrides
These practices reduce the risk of credential corruption, SSRF, and cross-request authentication bypass—key failure modes in the security domain.