- Shipped
- September 17, 2026 at 1:23 AM UTC
- Author
- Kamo
- Commit
- 096feaa
GET /api/security/org/{id} (and /org/domain/{host}) returns the Organization entity itself and answers without a session, and that body carried godaddyApiKey and godaddyApiSecret: the AES-GCM ciphertext of the org's GoDaddy credentials, whose own Javadoc said "Never returned to the frontend". A branch's response carried its PARENT's, because parent is an eager, unguarded relation, and the parent is exactly the org that holds the GoDaddy account its subdomains are created in. Confirmed live on 2026-09-17 with an unauthenticated curl against the platform org. Both fields are now @JsonIgnore, the convention every other ciphertext column here already follows (OrgCommissionStripeConfig, MortgageProviderConfig, BillingConnection, the ACH columns beside these). Nothing reads them from JSON: SecurityService loads them from the database (SubdomainBranchesController, DnsProvisioningService), writes them only from its own request map, and gives the UI godaddyConfigured. @JsonIgnore also stops a PUT /org/{id} body from setting them through the entity. **************** asserts it over every *_ENC column found by reflection, so the next encrypted column added to Organization is covered too. Verified by mutation: without the annotation, three of its four tests fail. Ships only when a dependent service rebuilds; securityservice, which serves the endpoint, is rebuilt next.