No literal internal-auth secret fallback — a blank public-chat secret answers 503

Shipped: October 14, 2026 at 4:10 PM UTC
Author: Kamo
Commit: cb10077

Seven @Value sites and application.yml fell back to the literal dev-secret-change-in-prod when **************** was missing, so a pod without its Secret sent a value readable in the repository as X-Internal-Auth. The defaults are now blank. InternalAuthSecretGate answers 503 for every controller that forwards with the secret when it is blank (logged, at most once a minute), PublicChatKeyResolver refuses to call MediaService without it (transient, so no key is cached invalid), and the public-chat WebSocket relay closes instead of connecting. The live ConfigMap (kamowsapi-config) and Secret (***) supply the value.

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free Forever View Pricing