- Shipped
- September 17, 2026 at 1:23 AM UTC
- Author
- Kamo
- Commit
- 6086830
The fix is in kamo-shared-library 096feaa1: Organization.godaddyApiKey and godaddyApiSecret are now @JsonIgnore. That change reaches production only when a service that serializes the entity rebuilds, and this is the service whose GET /api/security/org/{id} and /org/domain/{host} return it without a session. Until this build those responses held the AES-GCM ciphertext of the org's GoDaddy key and secret, and a branch's held its parent's. **************** serializes an org and a branch of it through the wire mapper MVC really uses (the shared bean with Hibernate6Module, copied by HttpWireJacksonConfig), so a module or mix-in registered here cannot quietly re-expose what the entity hid. Proven against the defect: built on the library without the annotation it fails; with it, it passes, and the ordinary body (alias, the quoted id) is intact.