Part of #525. From the BYOK security audit.
repository_ai_keys.key_version (src/db/schema.ts) is only ever set to encryptSecret's crypto-envelope version (always 1); it is not a rotation counter, and upsert overwrites in place. The name implies rotation tracking that doesn't exist.
Fix: clarify the schema comment to say it's the crypto-envelope version (chosen, low-risk), OR implement real rotation (increment on replace, retain prior last4/updatedAt for audit) if rotation is wanted.
Severity: low.
Part of #525. From the BYOK security audit.
repository_ai_keys.key_version(src/db/schema.ts) is only ever set to encryptSecret's crypto-envelope version (always 1); it is not a rotation counter, and upsert overwrites in place. The name implies rotation tracking that doesn't exist.Fix: clarify the schema comment to say it's the crypto-envelope version (chosen, low-risk), OR implement real rotation (increment on replace, retain prior last4/updatedAt for audit) if rotation is wanted.
Severity: low.