- Shipped
- September 23, 2026 at 7:48 AM UTC
- Author
- Kamo
- Commit
- 8f83034
The local-development defaults carried the database OWNER's password (${DB_PASSWORD:<literal>}), and apiservice/securityservice also the live changelog webhook HMAC secret — both verified equal to the live cluster secrets on 2026-09-23, and both in the history of nine repos. Production never read these (SPRING_CONFIG_LOCATION points every pod at its ConfigMap, and DB_PASSWORD comes from the *** secret as the kamo_app role), so they served only as a leak. The owner password was rotated the same day (the literal no longer authenticates — verified), and the defaults are now empty: a local run without the variable fails to authenticate instead of silently using production's owner credentials. The changelog webhook verifier already refuses a blank secret.