gochat/docs/security-key-rotation.md at e5a894b36bb2d2b619b5d4d63e5d1e6b8ec85cbe

Files

T

Rogeeandrogee f719529d66 fix(security): harden auth and secret handling (HH-444) (#101 )

* fix(security): harden auth and credential handling (HH-444)

* fix(security): address HH-444 review blockers

* fix(security): close remaining HH-444 review blockers

---------

Co-authored-by: Rogee <rogee@ipao.vip>

2026-08-22 15:45:06 +08:00

979 B

Raw Blame History

Sensitive-field key rotation

Keep the old key under encryption.previous_keys.<old-version>.
Set a new encryption.current_key_version and encryption.aes_key, then restart GoChat. New writes immediately use the new key; reads accept both.
Back up PostgreSQL, then run cd backend && GOCHAT_ENV=prod go run ./cmd/rotate_secrets.
Verify normal channel, webhook and integration traffic. Remove the old key only after every application and worker instance runs the new version.

The rotation command includes WhatsApp provider_config together with the channel access and webhook credentials.

Configuration rollback: restore the previous key version/key as current while retaining the new key in previous_keys, then restart all instances. The schema rollback does not narrow ciphertext-bearing columns. Rolling back to a binary that predates encrypted-field support requires restoring the pre-rotation database backup; that binary cannot decrypt ciphertext.

979 B Raw Blame History

Sensitive-field key rotation

979 B

Raw Blame History