0.13.6

A badge that named no subject leaves the sign-in page

The SSO half of the sign-in page carried a lone Encrypted badge beside OIDC Protected. It named no subject, so a reader could reasonably take it for transport security, for how the password they were typing is stored, or for the credentials of the database connections they would go on to save - three different promises, one word.

On the default STORAGE_PROVIDER=local it had no referent beyond the TLS the browser already indicates. Nothing is persisted server-side in that mode at all, and the browser's localStorage copy is plaintext by deliberate product decision - that is what lets Studio work without a master password.

Where encryption at rest does apply, it is worth stating precisely: with STORAGE_PROVIDER=sqlite or postgres, saved database passwords, connection strings, TLS client keys and SSH keys and passphrases are sealed with AES-256-GCM under an HKDF-derived key before they are written. That claim belongs where it is true, and not on a page where it is not.

OIDC Protected stays. It states something that branch actually does.

Reported by an external reader of the public demo, who was right.

Upgrade notes

None. No configuration moves, no data migrates, and no behaviour changes - this release removes a claim, not a control.

Helm chart: 0.1.56

Tracks app release 0.13.6. No packaged template and no value changes; artifacthub.io/containsSecurityUpdates is false for this version.

Full changelog: 0.13.5...0.13.6