This session replaced hardcoded production encryption keys with a dev-only fallback guarded by NODE_ENV (backend/utils/encryption.js, routes/generateProjectRoutes.js, routes/github.js, routes/projectRoutes.js). Dev still uses a known string key: 'dev-only-encryption-key-123'.
Work needed:
- Generate key entropy from a securely-random source in dev (e.g. environment-injected or generated at first boot)
- Document key rotation for existing encrypted tokens (changing the key invalidates stored GitHub OAuth tokens)
- Consider decrypt-and-reencrypt migration tooling
Why: a known dev key means any seeded dev environment shares one key; a leaked dev .env exposes all token ciphertext.
This session replaced hardcoded production encryption keys with a dev-only fallback guarded by NODE_ENV (backend/utils/encryption.js, routes/generateProjectRoutes.js, routes/github.js, routes/projectRoutes.js). Dev still uses a known string key: 'dev-only-encryption-key-123'.
Work needed:
Why: a known dev key means any seeded dev environment shares one key; a leaked dev .env exposes all token ciphertext.