---
description: 'Lens mutations are rejected inside internal/lensclient before token
  minting or transport use. The phone client exposes named readers only: GET endpoints…'
---

# Security

## Read-only boundaries

Lens mutations are rejected inside `internal/lensclient` before token minting or transport use. The phone client exposes named readers only: GET endpoints and the POST-only `config/get` reader. There is no generic request method.

The exporter never scans a network. A phone target must come from that device's Lens inventory record or from `phone.targets`.

## Phone identity

Poly phones use a private issuing CA and are commonly addressed by IP. Chain verification is therefore off by default, with `phone.tls.ca_file` available when the CA is installed. Certificate identity checking is separate and cannot be disabled: the certificate CN must equal the device MAC from Lens before Digest credentials are sent.

## Credentials

Keep secrets in environment injection or a protected environment file. Don't put them in YAML, Helm `--set` flags, shell history or repository fixtures.

The phone collector needs a local administrator credential. Set a real password; a short factory-style password makes the collector work but leaves the web interface weak.

Policy-derived passwords are redacted under all formatting verbs and excluded from errors, logs and signal attributes.