Context
index.md idioms say "keep secrets out of source; take secrets as [securestring] or through Get-Credential." The baseline Security standard covers least privilege and secret hygiene.
Gap
The community guidance is more precise, and our current wording ("take secrets … through Get-Credential") is slightly off for reusable functions:
- Take a
[PSCredential] parameter with the [System.Management.Automation.Credential()] attribute — do not call Get-Credential inside a reusable function, so callers can reuse a credential they already hold (and are still prompted securely if they pass only a username).
- Use
SecureString for other sensitive values (Read-Host -AsSecureString), and when you must decrypt one, free the BSTR (ZeroFreeBSTR) to avoid leaving the plaintext in memory.
- For credentials that must persist to disk,
Export-CliXml / Import-CliXml (DPAPI-protected) rather than plaintext.
Proposed change
Update the index.md security idiom (and/or the Security baseline) to prefer a [PSCredential] + [Credential()] parameter over calling Get-Credential inside a function, and add the SecureString and at-rest notes.
Source
PoshCode — Best Practices "Security".
Acceptance
The standard tells authors to accept credentials as a [PSCredential] parameter (rather than call Get-Credential internally) and covers SecureString handling.
Context
index.mdidioms say "keep secrets out of source; take secrets as[securestring]or throughGet-Credential." The baseline Security standard covers least privilege and secret hygiene.Gap
The community guidance is more precise, and our current wording ("take secrets … through
Get-Credential") is slightly off for reusable functions:[PSCredential]parameter with the[System.Management.Automation.Credential()]attribute — do not callGet-Credentialinside a reusable function, so callers can reuse a credential they already hold (and are still prompted securely if they pass only a username).SecureStringfor other sensitive values (Read-Host -AsSecureString), and when you must decrypt one, free the BSTR (ZeroFreeBSTR) to avoid leaving the plaintext in memory.Export-CliXml/Import-CliXml(DPAPI-protected) rather than plaintext.Proposed change
Update the
index.mdsecurity idiom (and/or the Security baseline) to prefer a[PSCredential]+[Credential()]parameter over callingGet-Credentialinside a function, and add the SecureString and at-rest notes.Source
PoshCode — Best Practices "Security".
Acceptance
The standard tells authors to accept credentials as a
[PSCredential]parameter (rather than callGet-Credentialinternally) and covers SecureString handling.