| Requirement | Why It Matters | |-------------|----------------| | | Even debug logs must mask decrypted values. | | Ephemeral memory | Use SecureString or equivalent where possible; clear variables explicitly. | | Key separation | Never hardcode keys inside the RPA script. Fetch them from a vault at runtime. | | Audit trail | Log that decryption occurred, but not the plaintext. | | Rotation support | Decrypter should handle key rotation without breaking workflows. |
$secure = ConvertTo-SecureString -String $env:ENCRYPTED_PWD -Key $key $plain = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto( [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure) )