Security documentation claims public keys are hashed, but code stores them in plaintext hex #416

Summary

The documentation at https://happy.engineering/docs/how-it-works/ claims:

"The server only saves a hash of your public key"
"The actual public key is deleted from memory right after you connect"
"If someone looks at the server's hard drive, they can't even see what public keys were used"

However, the actual implementation stores the full public key in hex format, not a hash.

Evidence

From authRoutes.ts:

const publicKeyHex = privacyKit.encodeHex(publicKey);

This uses encodeHex() from privacy-kit, which is a reversible encoding (not hashing). The original public key can be trivially recovered.

From prisma/schema.prisma:

• Account.publicKey - stored as plaintext string with @unique constraint
• TerminalAuthRequest.publicKey - stored as plaintext string
• AccountAuthRequest.publicKey - stored as plaintext string

Recommendation

Either:

1. Update the code to actually hash public keys (e.g., SHA-256) before storage
2. Update the documentation to accurately reflect what is stored

Note

Public keys being stored isn't necessarily a security vulnerability (they're meant to be public), but the documentation should accurately describe what the server stores.