mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-09-30 20:53:15 +00:00
148efeb269
Threat model T6: Fernet token-encryption key had no rotation path. Rotating TOKEN_ENCRYPTION_KEY immediately invalidated every github_token_encrypted value in thread metadata, forcing re-auth or bot-token re-resolution. Switch to cryptography.fernet.MultiFernet and parse TOKEN_ENCRYPTION_KEY as a comma- or newline-separated ordered list (most-recent-first). New writes encrypt under the first key; reads try every key. Deployers can prepend a new key, let active threads roll over, then drop the old key. Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> Co-authored-by: Johannes du Plessis <51395795+johannes117@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| integrations | ||
| middleware | ||
| tools | ||
| utils | ||
| encryption.py | ||
| prompt.py | ||
| reviewer.py | ||
| reviewer_diff.py | ||
| reviewer_findings.py | ||
| reviewer_publish.py | ||
| server.py | ||
| webapp.py | ||