chore(security): move dev SQLite database out of source tree and scrub PII#240
Open
0xtsotsi wants to merge 2 commits into
Open
chore(security): move dev SQLite database out of source tree and scrub PII#2400xtsotsi wants to merge 2 commits into
0xtsotsi wants to merge 2 commits into
Conversation
Adds `bun run security:rotate-mcp` to swap the connector in `.env` for a fresh bearer. Reads the old hash from `ai_mcp_connectors`, runs a transaction that creates the replacement row, deletes the old one, and verifies both inside the same transaction. Restores the old `INSTATIC_MCP_TOKEN` value on rollback only when the database still proves the rollback happened. This is the local-dev rotation helper; the admin endpoint that returns the plaintext once is the production path. The .env file remains gitignored.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
…b PII
The dev SQLite database used to live at ./.tmp/dev.db, under the
working tree. PII in that file (user email, argon2id password hash,
active sessions, audit events) is now written to a platform-native
per-user data directory:
- Linux: $XDG_DATA_HOME/instatic/dev.db
(default ~/.local/share/instatic/dev.db)
- macOS: ~/Library/Application Support/instatic/dev.db
- Windows: %LOCALAPPDATA%\instatic\dev.db
The new server/secrets/dataPaths.ts module is a sibling of the
master-key path helper from the previous commit and exposes
`perUserDataDir()`, `defaultDevDbPath()`, and `defaultDevDbUrl()`.
`INSTATIC_DATA_DIR` overrides the per-user data dir for operators
who want dev state on an external volume.
`bun run dev` no longer creates any file under `./.tmp/` for the
database. `scripts/db-drop.ts` continues to work because it
parses the URL through `parseSqlitePath`; it now targets the
per-user path.
The existing ./.tmp/dev.db* files have been deleted from the
working tree to scrub the PII. Production SQLite mode
(`compose.sqlite.yml`) is unaffected — it always wrote to
`/app/data/cms.db` on a named volume.
0xtsotsi
force-pushed
the
chore/move-dev-db
branch
from
July 22, 2026 20:24
af3d5a5 to
d36b352
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The dev SQLite database used to live at
./.tmp/dev.db, under the working tree. The file contained PII (user email, argon2id password hash, active sessions, audit events, AI provider credentials). The PII has been scrubbed; the database is now written to a platform-native per-user data directory outside the source tree.Changes
server/secrets/dataPaths.tswithperUserDataDir(),defaultDevDbPath(), anddefaultDevDbUrl()(Linux:$XDG_DATA_HOME/instatic/dev.db, macOS:~/Library/Application Support/instatic/dev.db, Windows:%LOCALAPPDATA%\instatic\dev.db).server/config.tsdefaultsDATABASE_URLtodefaultDevDbUrl()whenDATABASE_URLis unset.scripts/dev.tsuses the same default.INSTATIC_DATA_DIRoverrides the per-user data dir.scripts/db-drop.tscontinues to work — it parses the URL throughparseSqlitePathand now targets the per-user path..env.exampledocuments the new behaviour andINSTATIC_DATA_DIRoverride.Files
server/secrets/dataPaths.ts(new)server/config.tsscripts/dev.ts.env.exampleVerification
bun run lintclean.tsc -bclean.INSTATIC_ALLOW_DEV_KEY_AUTOGEN=1 PORT=3999 bun run dev:serverboots cleanly, creates~/Library/Application Support/instatic/dev.db(no file under./.tmp/), and serves on port 3999../.tmp/dev.db*files have been deleted from the working tree to scrub the PII.compose.sqlite.yml) is unaffected — it always wrote to/app/data/cms.dbon a named volume.