SecretPropertys 1.0.0

SecretPropertys

SecretPropertys is a powerful .NET NuGet package that secures your sensitive information (API keys, connection strings, passwords) in C# applications using Roslyn source generators. It automatically obfuscates secrets at build time, preventing clear text secrets from appearing in your compiled output or being discoverable through decompilation.

✨ Features

• Strong Encryption: Uses AES-256 encryption with assembly-specific keys to protect your secrets
• Simple Integration: Mark properties with [BuildSecret] attribute to identify values that should be secured
• Compile-Time Protection: Encrypts secrets during the build process - no clear text in compiled assemblies
• Anti-Tampering: HMAC verification to detect and prevent modification of obfuscated secrets
• Decompiler Protection: Runtime checks to detect when code is running in a decompiler
• Build-Time Configuration: Supply secrets via command-line parameters or project files
• Zero Runtime Dependencies: All decryption code is generated inline - no external packages required
• Comprehensive Diagnostics: Detailed build-time messages when secrets are missing or invalid

🚀 Installation

Install the SecretPropertys NuGet package:

dotnet add package SecretPropertys

Or via the NuGet Package Manager:

Install-Package SecretPropertys

📋 Usage Guide

1. Mark Properties for Secret Handling

using SecretPropertys.Attributes;

// Add the partial keyword to allow the source generator to extend this class
public partial class Configuration
{
    [BuildSecret(Key = "ApiKeySecret")]
    public static string ApiKey { get; private set; }

    [BuildSecret(Key = "ConnectionStringSecret")]
    public static string ConnectionString { get; private set; }
}

2. Make Secrets Available During Build

Option 1: Define in Project File (.csproj)

<PropertyGroup>
    <ApiKeySecret>your-secret-api-key</ApiKeySecret>
    <ConnectionStringSecret>your-connection-string</ConnectionStringSecret>
</PropertyGroup>

<ItemGroup>
    <CompilerVisibleProperty Include="ApiKeySecret" />
    <CompilerVisibleProperty Include="ConnectionStringSecret" />
</ItemGroup>

Option 2: Supply via Command Line

dotnet build /p:ApiKeySecret=your-secret-api-key /p:ConnectionStringSecret=your-connection-string

3. Use the Secured Properties

At runtime, the properties will be automatically initialized with the decrypted values:

// The secret is automatically decrypted at runtime
Console.WriteLine($"Using API with key: {Configuration.ApiKey}");

🔒 Security Details

SecretPropertys protects your secrets using:

1. Layered Encryption: AES-256 encryption using keys derived from assembly metadata
2. Key Derivation: PBKDF2 with a high iteration count for deriving encryption keys
3. Anti-Tampering: HMAC-SHA256 to verify integrity of the encrypted data
4. Anti-Debugging: Runtime integrity checks to detect execution in decompilers
5. Dynamic Security: Build-time random salt generation for unique encryption per build
6. Fail-Fast Approach: Application termination if secrets are tampered with or decryption fails

⚠️ Important Considerations

• Secrets are protected from decompilation, but they still exist in memory at runtime
• Use access control and proper permissions for build machines/CI systems with access to secrets
• Do not commit secrets directly in project files to source control
• Consider using environment variables or secure CI/CD solutions for production deployments

🧰 Advanced Configuration

Custom Error Handling

Add custom handling when secrets fail to load:

try 
{
    // Use your secured properties
    var api = new ApiClient(Configuration.ApiKey);
}
catch (InvalidOperationException ex) when (ex.Message.Contains("Failed to decrypt secret"))
{
    // Handle secret decryption failures
    Logger.Error("Secret decryption failed", ex);
    Environment.Exit(1);
}

Using with Dependency Injection

public static void ConfigureServices(IServiceCollection services)
{
    // Register a configured API client using the secured API key
    services.AddSingleton<IApiClient>(sp => new ApiClient(Configuration.ApiKey));
}

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.