chore(security): move master encryption key out of source tree#239
Open
0xtsotsi wants to merge 2 commits into
Open
chore(security): move master encryption key out of source tree#2390xtsotsi wants to merge 2 commits into
0xtsotsi wants to merge 2 commits into
Conversation
added 2 commits
July 22, 2026 22:05
Adds `bun run security:rotate-mcp` to swap the connector in `.env` for a fresh bearer. Reads the old hash from `ai_mcp_connectors`, runs a transaction that creates the replacement row, deletes the old one, and verifies both inside the same transaction. Restores the old `INSTATIC_MCP_TOKEN` value on rollback only when the database still proves the rollback happened. This is the local-dev rotation helper; the admin endpoint that returns the plaintext once is the production path. The .env file remains gitignored.
Adds `server/secrets/paths.ts` with platform-native per-user config
directory resolution ($XDG_CONFIG_HOME/instatic on Linux,
~/Library/Application Support/instatic on macOS, %APPDATA%\instatic
on Windows).
`server/secrets/masterKey.ts` now reads keys in this priority:
1. INSTATIC_SECRET_KEY env var (unchanged).
2. INSTATIC_SECRET_KEY_FILE, when set to an absolute path.
3. The platform-native per-user key file, but only when
INSTATIC_ALLOW_DEV_KEY_AUTOGEN=1.
The .tmp/secret.key fallback is removed. With the opt-in flag unset,
`bun run dev` now fails closed with a clear message instead of writing
a key into the working tree. Production behavior (require
INSTATIC_SECRET_KEY) is unchanged.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The dev master encryption key (AES-256-GCM, chmod 0600) used to be auto-generated at
./.tmp/secret.keywheneverINSTATIC_SECRET_KEYwas unset. Even though the file is gitignored, it lived under the working tree and contained the root secret that protects every reversible secret in the dev DB (AI provider credentials, plugin secrets, TOTP seeds).This commit moves the dev fallback to a platform-native per-user config directory and adds an opt-in env flag.
Changes
server/secrets/paths.tswithperUserConfigDir()anddefaultMasterKeyPath()(Linux:$XDG_CONFIG_HOME/instatic/secret.key, macOS:~/Library/Application Support/instatic/secret.key, Windows:%APPDATA%\instatic\secret.key).server/secrets/masterKey.tsnew priority:INSTATIC_SECRET_KEYenv var (unchanged).INSTATIC_SECRET_KEY_FILE, when set to an absolute path.INSTATIC_ALLOW_DEV_KEY_AUTOGEN=1../.tmp/secret.keyfallback is removed. With the opt-in flag unset,bun run devfails closed with a clear error message.INSTATIC_SECRET_KEYrequired whenNODE_ENV=production) is unchanged.scripts/dev.tsfails fast with a clear error when no key source is configured..env.exampleand.env.production.exampledocument the new env vars..gitignoreadds a clarifying comment.Files
server/secrets/paths.ts(new)server/secrets/masterKey.tsscripts/dev.ts.env.example.env.production.example.gitignoreVerification
bun run lintclean.tsc -bclean.INSTATIC_ALLOW_DEV_KEY_AUTOGEN=1unset andINSTATIC_SECRET_KEY="",bun run devexits with a clear error.INSTATIC_ALLOW_DEV_KEY_AUTOGEN=1, the dev key file is created at the per-user path (verified at~/Library/Application Support/instatic/secret.keyon macOS) and re-used on later boots.INSTATIC_SECRET_KEY_FILE=/abs/path bun run devreads from that file../.tmp/secret.keyhas been removed from the working tree.