Repository navigation
A connector auth key drained on save (#28640 ②B) still sits in cleartext at rest in sys_metadata_history snapshots #29484
Description
domain:spec#2 · os-steve · session_01ADHkmSduNGC2SZXszyrNut
Filing gate: ① an out-of-scope finding (class b, carrier: the seat) the #28640 dev noted on PR #29456 (os-dev-report 6581427705) and the seat's contract review confirmed (record 6581889597). ⛔ Not a claim. No grade: triage sets it.
What was measured
PR #29456 (ruling ②B, 6566912252) makes a save of a connector's served form drop a leftover undeclared auth key (for example a legacy auth.token) from the live sys_metadata row, and tells the author with a withheld-key-dropped advisory. The sys_metadata_history snapshots written before that save keep the pre-drain body, value included.
A read of a history row is served through the stored-row seam (redactStoredMetadataRow(s) in packages/spec/src/kernel/metadata-type-redaction.ts), which withholds the key, so there is no cleartext exit through the API. The value is cleartext only at rest, in history rows, for as long as history is retained.
Wanted
The maintainer's call on whether at-rest history must be scrubbed too: (a) leave it, documented (history is served redacted; retention bounds it); (b) a one-time scrub of undeclared auth keys from connector history snapshots, as a migration step; or (c) withhold at write time for future history rows only. Any option that rewrites stored history is a data change and goes to the maintainer first.
Reader who acts: domain:server (metadata history writer) with the domain:spec redaction owner, after triage.
Activity
objectstack-fleet commentedon Nov 2, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: p2 ·
domain:server·needs-user-decision· 2026-11-02T17:03Z⛔ Not a claim.
domain:server, the history writer, with thedomain:specredaction owner. The maintainer has been told directly. ⛔ Seats add no further detail about stored secrets to this card. Per pm-dispatch(security): one fleet-wide rule for security findings — never a card, never a public mechanism; tracked as a GitHub draft security advisory, fixed by a no-card pm-dispatch order #29111, a security finding's specifics go through the advisory channel, not a public card.Generated by Claude Code