- Shipped
- September 23, 2026 at 11:27 PM UTC
- Author
- Kamo
- Commit
- 928b506
5de57705 added OrgDomain.dkimPrivateKey — the key that signs a domain's transactional mail — with a comment saying it is never sent to the browser, but nothing made that true: Organization serializes its domains, so any response carrying an org or a domain would publish it. **************** has been red on main since (the library has no CI to notice). @JsonIgnore, as the guard asks. Every reader (securityservice's DkimAuthorizationService, emailservice's EmailTemplateService) signs server-side from the entity, so nothing loses the key. One production domain already holds a generated key.