Repository navigation
Authn/Authz: Enhanced security for client credentials management #416
Description
Current: single master secret key encrypts all client credentials
Desired: should use AWS KMS or something similar to manage encryption for client credentials
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
[-]Enhanced security for credentials management[/-][+][Authn/Authz] Enhanced security for client credentials management[/+][-][Authn/Authz] Enhanced security for client credentials management[/-][+]Authn/Authz: Enhanced security for client credentials management[/+]AkhileshNegi commentedon Jun 30, 2026
Why now: The credentials table is still small. Migrating it now is much easier than waiting until it grows. Single-secret encryption is also a known audit gap and likely will not pass a security review, so it is better to fix it now.
Scope: This is a major structural change to the credentials table, similar in size to the API key change. We will move from single-secret encryption to KMS envelope encryption. The root/master key will be managed at the ops level, not stored in code.
github-actions commentedon Jul 16, 2026
🎉 This issue has been resolved in version 1.4.0-main.4 🎉
The release is available on GitHub release
Your semantic-release bot 📦🚀