Secrets stored in clear in SQLite (CI secrets, webhook secrets, mirror tokens) #273

closed cmc opened this on 2026-09-28 04:33 UTC · security store

Discussion

cmc 2026-09-28 04:33 UTC

CI secrets, webhook secrets, mirror tokens and APNs device tokens are stored in clear in SQLite: build_secrets.value, webhooks.secret, mirrors.token, push_devices.token. The code base has no at-rest encryption; protection is file permissions (database 0640, data directory 0750) and the write-only interface. Anyone who reads the database file or a backup gets every one of them.

Encrypt these columns with a key held outside the database (a file under /etc/gitbay, mode 0600, not in backups), or document the decision not to.
Rotation path for the key.

See Architecture/06-Data-and-Cryptography and 09-Controls.

referenced in commit fc5b1b67a2 by cmc: wiki: Architecture overview names diagrams; titles drop their numbers; gaps filed

2026-09-28 04:36 UTC

referenced in commit 4e0958a163 by cmc: plans: open issues from the architecture and UX reviews

2026-09-28 05:43 UTC

referenced in commit b711b70da5 by cmc: plans: apply decisions on the open questions

2026-09-28 06:16 UTC

closed by cmc in commit 7e5de5325c: deploy, wiki: provision and document the secret key file

2026-09-28 22:37 UTC

referenced in commit 1481a12712 by cmc: e2e: a key file per instance; the archive carries secrets sealed and no key

2026-09-28 22:37 UTC

referenced in commit 24b9cdbca1 by cmc: gitbayd: load the secret key file; admin secrets init, rotate, check

2026-09-28 22:37 UTC

referenced in commit 1ec2c9cfb7 by cmc: store: seal CI secrets, webhook secrets, mirror tokens and device tokens

2026-09-28 22:37 UTC

referenced in commit b13a24703d by cmc: config: server.secret_key_file, outside server.root

2026-09-28 22:37 UTC

referenced in commit ed99c936ad by cmc: seal: AES-256-GCM keyring for secret columns

2026-09-28 22:37 UTC

referenced in commit 4cf9a72907 by cmc: secrets: serialize init and rotate on a lock beside the key file

2026-09-28 23:09 UTC