nogueiraguh 7b50767159 security: Fernet encryption, export sanitization, sensitive settings protection ...

- Replace base64 _enc/_dec with Fernet (AES-128-CBC + HMAC-SHA256) derived from APP_SECRET
- Auto-migrate legacy base64 data to Fernet on startup (backward compatible)
- Remove all credentials from config export (private keys, passwords, OCIDs, passphrases)
- Block sensitive settings (oidc_*, secret_*) from non-admin read
- Block sensitive settings import
- Import OCI configs as metadata-only (credentials reconfigured manually)

2026-04-01 10:50:51 -03:00

514 KiB

Raw Blame History

View Raw