Skip to content
Veltrosecurity

Contributing integrations

Source of truth: docs/contributing/integrations.md (synced at build time — edit the original, not this copy). An integration belongs where it executes:

  • Warden pack definitions: warden/content/packs/; registered action and connection implementations: warden/backend/.
  • Sigmatic detection and integration content: sigmatic/content/; threat-intelligence source and API implementations: sigmatic/backend/app/.
  • VectorFlow pipeline packs: vectorflow/content/packs/; edge integrations: vectorflow/agent/; component schemas and server implementations: vectorflow/src/.

The listed content directories and VectorFlow’s edge agent are Apache-2.0. Backend, component-schema, and server runtime code keeps the owning repository’s AGPL-3.0 license.

Security contract

Section titled “Security contract”
  • Store secrets through the product secret or connection store. Never put them in URLs, argv, logs, fixtures, or API responses.
  • Cap external response bodies and set timeouts.
  • Validate outbound destinations with the repository’s existing SSRF guard.
  • Keep write or response actions behind Warden approval. An adapter without a configured backend must report enforcement_performed: false; it must not claim success.
  • Keep the only realm fixed to default. Do not add realm selection.
  • Use recorded, redacted fixtures when a vendor cannot run in CI, and mark the pack verified: fixture.

Implement and validate

Section titled “Implement and validate”

Reuse an adjacent provider and its error vocabulary. Add a focused contract test that proves authentication, request mapping, a real provider error, and response normalization. For reversible enforcement, prove block, expiry, and unblock semantics.

Run the owning repository’s content validator:

Terminal window
# Warden packs and runbooks
python3 scripts/validate_content.py


# Sigmatic rules and detection packs
python3 scripts/validate_content.py


# VectorFlow packs
node scripts/validate_content.mjs


# VectorFlow component catalogs (normal product CI)
node scripts/vector-catalog-audit.mjs
node scripts/otel-catalog-audit.mjs

Then run only the focused provider or adapter tests you changed. Content-only pull requests run pack validation on the existing shared self-hosted X64 pool. Component-schema and runtime changes run normal product CI.

Documentation

Section titled “Documentation”

Add configuration fields, least-privilege vendor permissions, supported operations, and the verification level. Never publish real credentials or customer payloads.