BambooHR Integration Security
Overview
Treat the connector as a high-sensitivity HR data system. Security is not only secret storage: it includes tenant isolation, field-level authorization, data minimization, webhook authenticity, auditability, and deletion.
Prerequisites
- The target repository or integration path and the requested operator outcome.
- The tenant, identity, and data scope only when approved live work is in scope.
- The current evidence register plus customer-specific permissions and agreements.
Current Contract
BambooHR permissions affect which employee fields and operations an identity can access. The official SDK supports secure logging and request-ID extraction, but application logs, queues, databases, exports, and support artifacts remain the operator's responsibility. Webhook creation returns a one-time private key.
Authentication
Use OAuth for partner integrations with validated state, exact HTTPS redirect
URIs, encrypted per-subject token storage, and persisted token rotation. For API
keys, use a dedicated least-privilege user, named owner, expiry review, and
tested revocation. Never share one identity across tenants.
Instructions
- Map trust boundaries: user/browser, callback, token store, connector, BambooHR tenant, queue, destination, logs, backups, support, and analytics.
- Inventory every requested field and classify sensitivity. Remove fields not tied to an approved purpose; isolate government IDs, compensation, medical, dependent, benefit, and file data.
- Enforce tenant from trusted credential metadata, not from a request body. Validate identifiers at every queue and storage boundary.
- Redact authorization, keys, cookies, query strings, webhook secrets, and HR values. Allow request IDs, operation names, status, latency, and safe counts.
- For webhooks, store the creation-only key atomically, verify HMAC-SHA256 over raw bytes using the currently documented carrier, compare in constant time, and reject before parsing or side effects.
- Encrypt in transit and at rest, set retention and deletion jobs, restrict backup access, and test subject/customer deletion obligations.
- Exercise cross-tenant access, denied fields, revoked credentials, replay, log injection, oversized payload, SSRF-like tenant input, and support-bundle exfiltration in tests.
Tool Discipline
Use Read, Glob, and Grep for code and configuration inspection. Use Write/Edit only for explicitly approved hardening and regression tests. Never write sample secrets or real employee records.
Approval Boundaries
Require security/data-owner approval before broadening fields, OAuth scopes, API-key permissions, retention, destinations, webhook events, or support access. Do not rotate or revoke live credentials as part of an audit without approval.
Output
Return assets, trust boundaries, field inventory, identities and permissions, findings by severity, exact remediation, test evidence, retention/deletion controls, owners, and unresolved risk acceptances.
Error Handling
- Suspected secret or HR-data exposure: stop collection, preserve minimal audit metadata, and invoke the organization's incident process.
- Cross-tenant ambiguity: fail closed before a BambooHR or destination request.
- Missing webhook verification contract: disable processing, not verification.
Examples
- "Review our BambooHR logs" searches for sensitive categories without printing values.
- "Give the connector admin access" is replaced by an operation/field permission map.
Resources
Read official evidence and the executed customer agreements before finalizing controls.