# Security Patterns

> Use this skill when working on credentials, secrets, environment variables, Docker security, or any security-related concern. Triggers on: secrets management, credential handling, Docker security, environment variables, or mentions of "security", "secrets", "credentials", "env vars", or "vulnerability".

- Skill: `majiayu000/security-patterns-4` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/security-patterns-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/security-patterns-4/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/security-patterns-4

---


# Security Patterns — DoclingOptimisation

## Secrets Management
- Environment variables for all runtime configuration (DOCLING_* vars)
- Never hardcode API keys, tokens, or credentials in code
- Docker Hub credentials via GitHub Secrets in CI/CD
- Azure Container App secrets for runtime environment variables

## Docker Security
- Non-root user (`docling:docling`) in runtime image
- No dev dependencies in runtime stage
- Minimal runtime packages (only what's needed)
- No shell access in production (consider `--no-install-recommends`)
- Pin base image versions to prevent supply chain attacks

## Model Downloads
- Models pre-fetched at build time from HuggingFace Hub and ModelScope CDN
- `HF_HUB_ETAG_TIMEOUT=0` and `HF_HUB_DOWNLOAD_TIMEOUT=5` prevent runtime downloads
- Verify model integrity if moving to a private registry

## Input Validation
- PDF path validation in process.py (exists, is file, is readable)
- File size limits should be enforced at the Container App Job level
- Never trust user-provided paths without validation