Skip to content

v0.57.0 — security: secrets-handling hardening (SEC-005..008)

Choose a tag to compare

View all tags
@daniel-garcia daniel-garcia released this 04 Jul 19:19
v0.57.0
de60c43

Secrets-handling hardening from the WS-030 dedicated secrets sweep.

  • SEC-005: redact the DSN in migrate errors so credentials no longer leak into error text or logs.
  • SEC-006: both persistence generators (ent + storage) now return the persistence.ErrNoEncryptor sentinel and fail loudly when a secret field is set but no encryptor is configured, instead of silently dropping the field.
  • SEC-007: generators omit INPUT_ONLY fields from response projections, and the scaffold documents the guarantee.
  • SEC-008: secret.NewDev now requires an exact 32-byte key, and the vault path surfaces a status-only error.

Compatibility:

  • SEC-006 and SEC-007 are behavior-change-on-regen — the difference lands when a consumer re-runs code generation.
  • SEC-008 is a breaking change to the dev encryptor (secret.NewDev rejects non-32-byte keys).
Assets 2
Loading