- Shipped
- September 23, 2026 at 8:33 AM UTC
- Author
- Kamo
- Commit
- 192169b
A sweep of every repo for the values of the cluster's live Secrets (2026-09-23) found copies here: the JWT signing secret as a `${JWT_SECRET:<literal>}` default (in production ConfigMaps too), the Vonage key and secret, and — in a committed deployment-diagnostics dump and a generated config — the Twilio credentials and the notes master key. They are replaced with empty/placeholder defaults (`<redacted>` in the dumps; test SIDs keep their shape). Production reads every one of them from a Secret. The JWT signing secret was rotated the same day (nothing verifies with it today: JWTUtils has no callers). The Twilio auth token and Vonage secret still need rotating at the providers; the notes master key needs a re-encryption plan first.