[michaelelrom]

Hardens the three secret provider plugins so a failed lookup can't put sensitive data in Itential Gateway's error log, makes the READMEs say plainly how the secret value is handled, and adds contribution rules for secret provider plugins.

Itential Gateway copies a failed plugin's stderr into its error log unredacted, so stderr is the main place a plugin can leak.

Plugins

• stderr carries only fixed text, an HTTP status, or the provider's error type. Removed: AWS error bodies (these included IAM user ARNs and account IDs), the AWS_CREDENTIAL_PROCESS command line, file paths, Azure managed identity response bodies, and tracebacks (a top-level handler prints the exception type only).
• Redirects are not followed. urllib forwards the Authorization header to the redirect target.
• Azure and Delinea require https:// URLs, and path/key are URL-encoded.
• Behavior change: if key is given and the secret is a JSON object without that field, the AWS and Azure plugins now fail with "key not found in secret" instead of returning the whole object.

READMEs

• New "How the Secret Value Is Handled" section: plugin stdout is an in-memory pipe, not a terminal, file or log.
• The direct test command no longer prints the secret to the terminal (the AWS README's did; Azure and Delinea gain one). The Azure managed identity check no longer prints the secret either.
• Credential files are created without leaving the value in shell history.
• The config.env description said "non-sensitive values". Every --env value is sent on stdin, so it now says to keep credentials in files.
• Azure troubleshooting no longer quotes the managed identity response body, which the plugin no longer prints.

Contribution rules

• STANDARDS.md: Secret Provider Plugins section.
• CONTRIBUTING.md: checklist item. AGENTS.md: one line.
• .github/scripts/check-secret-plugins.py: regex checks for the patterns above. It reports 0 findings on these plugins. It is not wired into CI.

Testing

Run locally with mock servers and marker values, no real secrets:

• A marker in a credential-process argument and in a key file path appeared in stderr before and not after.
• The AWS error type is extracted from a fake error body, and a body with an ARN, a non-JSON body and a hostile __type all return "unknown error".
• A redirect to a second host no longer carries the Authorization header.
• Azure (client secret), Delinea and AWS success paths still return the right value, including key extraction, with the HTTP layer faked.
• README anchors checked against GitHub's slug rules.

Not tested: the real AWS, Azure and Delinea services, the Azure IMDS success path, and Itential Gateway 5.5.3 running the patched plugins.