docs(security): add secrets management and environment protection (#92)

- Add Secrets Management section to SECURITY.md
- Document all 15 secrets used in CI/CD workflows
- Add production environment to publish.yml and unpublish.yml
- Marketplace secrets now protected by GitHub Environment
- Bump version to 0.10.41

🖥️ IDE: [Cursor](https://cursor.sh)
🔌 Extension: [Claude Code](https://claude.ai/download)


Model-Raw: claude-opus-4-5-20251101

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: nullvariant

.github/workflows/publish.yml

@@ -10,6 +10,7 @@ permissions: {}
 jobs:
   publish:
     runs-on: ubuntu-latest
+    environment: production
     # Prevent forks from publishing
     if: github.repository == 'nullvariant/nullvariant-vscode-extensions'
     permissions:

.github/workflows/unpublish.yml

@@ -18,6 +18,7 @@ permissions: {}
 jobs:
   unpublish:
     runs-on: ubuntu-latest
+    environment: production
     permissions:
       contents: read
     # Prevent forks from unpublishing (no marketplace secrets)

SECURITY.md

@@ -22,7 +22,7 @@ If you discover a security vulnerability, please report it by:
    - We will respond within 48 hours
 
 2. **Email**
-   - security@nullvariant.com
+   - `security@nullvariant.com`
    - Use PGP encryption if possible (key available on request)
 
 **Please do NOT open a public issue for security vulnerabilities.**
@@ -55,6 +55,69 @@ npm run test:security
 ```
 
 This includes tests for:
+
 - Command injection vectors
 - XSS prevention in webviews
 - CSP policy enforcement
+
+## Secrets Management
+
+This section documents all secrets used in CI/CD workflows.
+
+### Repository Secrets
+
+| Name | Purpose | Used In | Rotation | Sensitivity |
+| ---- | ------- | ------- | -------- | ----------- |
+| VSCE_PAT | VS Code Marketplace publishing | publish.yml, unpublish.yml | Annual | High |
+| OVSX_PAT | Open VSX publishing | publish.yml, unpublish.yml | Annual | High |
+| CODECOV_TOKEN | Coverage reporting | ci.yml | As needed | Medium |
+| CLOUDFLARE_API_TOKEN | Cloudflare Pages/R2 deployment | deploy-docs.yml, publish.yml | Annual | High |
+| CLOUDFLARE_ACCOUNT_ID | Cloudflare account identifier (public) | deploy-docs.yml, publish.yml | Never | Low (public ID) |
+
+### GitHub App Secrets (6 bots × 2 secrets each)
+
+| Bot | Secrets | Used In |
+| --- | ------- | ------- |
+| Justice | JUSTICE_BOT_APP_ID, JUSTICE_BOT_PRIVATE_KEY | justice-bot.yml |
+| Luna | LUNA_BOT_APP_ID, LUNA_BOT_PRIVATE_KEY | luna-bot.yml |
+| Slow | SLOW_BOT_APP_ID, SLOW_BOT_PRIVATE_KEY | slow-bot.yml |
+| Blaze | BLAZE_BOT_APP_ID, BLAZE_BOT_PRIVATE_KEY | blaze-bot.yml |
+| Ciel | CIEL_BOT_APP_ID, CIEL_BOT_PRIVATE_KEY | ciel-bot.yml |
+| Mimi | MIMI_BOT_APP_ID, MIMI_BOT_PRIVATE_KEY | mimi-bot.yml |
+
+**Security Notes for GitHub Apps**:
+
+- Private Keys do not expire, but annual rotation is recommended
+- APP_IDs are public identifiers (low sensitivity)
+- Private Keys are high sensitivity - treat as passwords
+- Each bot has minimal permissions scoped to its specific function
+
+### Environment Protection
+
+Marketplace publishing secrets (VSCE_PAT, OVSX_PAT) are protected by the `production` environment, which requires:
+
+- Tag push matching `git-id-switcher-v*` pattern
+- Repository owner approval (optional)
+
+**Note**: CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID remain as repository secrets (not environment secrets) because they are also used by deploy-docs.yml, which triggers on main branch push.
+
+### Rotation Procedure
+
+1. **Generate new token** from the provider (Azure DevOps, Open VSX, Cloudflare)
+2. **Update GitHub secret** in repository settings
+3. **Verify workflow execution** by triggering a test run
+4. **Revoke old token** from the provider
+
+### Provider Links
+
+| Secret | Provider | Management URL | Expiration |
+| ------ | -------- | -------------- | ---------- |
+| VSCE_PAT | Azure DevOps | [Azure DevOps Tokens](https://dev.azure.com/nullvariant/_usersSettings/tokens) | 2027-01-08 |
+| OVSX_PAT | Open VSX | [Open VSX Tokens](https://open-vsx.org/user-settings/tokens) | No expiration |
+| CLOUDFLARE_API_TOKEN | Cloudflare | [Cloudflare API Tokens](https://dash.cloudflare.com/profile/api-tokens) | No expiration |
+| CODECOV_TOKEN | Codecov | [Codecov Settings](https://app.codecov.io/account/gh/nullvariant/settings) | No expiration |
+| GitHub App Keys | GitHub | [GitHub Apps](https://github.com/settings/apps) | No expiration |
+
+**Token Details**:
+
+- **CLOUDFLARE_API_TOKEN**: Named `nullvariant-vscode-extensions-github-actions-deploy`, permissions: Workers R2 Storage:Edit

extensions/git-id-switcher/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.10.41] - 2026-01-09
+
+### Security
+
+- **CI/CD: Environment Protection for Marketplace Publishing**
+  - Added `production` environment to publish.yml and unpublish.yml
+  - Marketplace secrets (VSCE_PAT, OVSX_PAT) now protected by GitHub Environment
+  - Requires tag push matching `git-id-switcher-v*` pattern
+  - Implements least privilege principle for CI/CD secrets
+
+### Added
+
+- **Secrets Management Documentation**
+  - Added comprehensive Secrets Management section to SECURITY.md
+  - Documents all 15 secrets used in CI/CD workflows
+  - Includes rotation procedures and provider links
+  - Added sensitivity levels for each secret
+
 ## [0.10.40] - 2026-01-09
 
 ### Changed
@@ -1003,7 +1021,8 @@ This release includes comprehensive security hardening across multiple areas.
 - `gitIdentitySwitcher.autoSwitchSshKey`: Auto SSH key switching
 - `gitIdentitySwitcher.showNotifications`: Show switch notifications
 
-[Unreleased]: https://github.com/nullvariant/nullvariant-vscode-extensions/compare/git-id-switcher-v0.10.40...HEAD
+[Unreleased]: https://github.com/nullvariant/nullvariant-vscode-extensions/compare/git-id-switcher-v0.10.41...HEAD
+[0.10.41]: https://github.com/nullvariant/nullvariant-vscode-extensions/compare/git-id-switcher-v0.10.40...git-id-switcher-v0.10.41
 [0.10.40]: https://github.com/nullvariant/nullvariant-vscode-extensions/compare/git-id-switcher-v0.10.39...git-id-switcher-v0.10.40
 [0.10.39]: https://github.com/nullvariant/nullvariant-vscode-extensions/compare/git-id-switcher-v0.10.38...git-id-switcher-v0.10.39
 [0.10.38]: https://github.com/nullvariant/nullvariant-vscode-extensions/compare/git-id-switcher-v0.10.37...git-id-switcher-v0.10.38

extensions/git-id-switcher/package.json

@@ -2,7 +2,7 @@
   "name": "git-id-switcher",
   "displayName": "%extension.displayName%",
   "description": "%extension.description%",
-  "version": "0.10.40",
+  "version": "0.10.41",
   "publisher": "nullvariant",
   "icon": "images/icon.png",
   "engines": {