A proper 32-byte key for saved provider API keys, no default, no plaintext fallback (TPVAULT side fix)

Shipped

November 6, 2026 at 8:19 PM UTC

Author

Kamo

Commit

ac0a621

AI_PROVIDER_KEY (Secret ai-provider-key, 32 random bytes) or the service will not start; new values are v2: + AES-256-GCM with associated data. The old padded-string key is kept only to read pre-v2 rows: at startup each one is decrypted, re-encrypted under v2, verified and replaced only if unchanged (all 8 production rows were checked to decrypt first). A row that will not decrypt is no longer used as a key.