Skip to main content

Guide to Password and Token Best Practices in Data2 Builder

To ensure the security of systems built using Data2 Builder, all developers must follow the guidance in this guide. Failure to follow these practices can leave your project vulnerable to sensitive data leaks or compromise the system's integrity.

1. Never expose sensitive information in any Builder Inspector field​

Never enter passwords, tokens, API keys, or any other confidential data into component props (Block, Artboard, If, etc). This includes any field within Data2 Builder components (usually enterable inside the Inspector), even if the system is still in testing or development.

2. The correct place for secrets is the KeyVault​

Always store sensitive information (passwords, tokens, API keys, etc.) in Data2's KeyVault, using the KeyVault's own Renderable (click the +Add button at the top of the KeyVault and enter the key name and its value in the form that opens inside the KeyVault's Renderable). Never fill in passwords using the Inspector fields. The KeyVault is designed to protect this data and make it available to the system securely and in a controlled way. The password is stored encrypted inside the KeyVault.

3. Extra caution with mocks​

Never include real password, token, or API key values in mocks: This applies to Component mocks, HttpRequest mocks, or any other simulation. Only use fictitious, generic values that do NOT work for real authentication (e.g., "sample_password", "fake_token123"). If you need to test with a real password, do so via the KeyVault.

4. Security checklist when finishing a task​

Review all props of all components and make sure there's no sensitive information. Make sure all confidential data is in the KeyVault. Check parameter mocks, making sure there are no real passwords, tokens, or information (Note: besides passwords and tokens, also don't expose customer information or real people's data).

5. Found an exposure? What to do​

Immediately move the password (or token, API key, etc.) to the KeyVault. Use the Builder's search tool to find every place the sensitive data was entered. Replace all direct references with a reference to the KeyVault (remember: to use KeyVault keys you need to drag and drop the key into the location where you'll use it). Notify the team about the fix and, if necessary, generate new credentials to ensure security.