Skip to content

sec(storage): implement in-memory secret scrubbing for database passwords and credentials (#607) - #623

Merged
ZhuchkaTriplesix merged 1 commit into
devfrom
issue/607-secret-scrubbing
Aug 26, 2026
Merged

sec(storage): implement in-memory secret scrubbing for database passwords and credentials (#607)#623
ZhuchkaTriplesix merged 1 commit into
devfrom
issue/607-secret-scrubbing

Conversation

@ZhuchkaTriplesix

Copy link
Copy Markdown
Member

Summary

Implements zero-trust memory security by clearing and scrubbing in-memory database passwords and connection URI secret buffers immediately after establishing database connections.

Changes

  1. ConnectionRow:
    • Added withoutSecrets() method to return a sanitized copy with password and connectionString scrubbed to null.
    • Added credential status helpers: hasPassword, hasConnectionString, and hasSecrets.
  2. Database Drivers:
    • Implemented scrubCredentials() in PostgresConnection, MysqlConnection, RedisConnection, and MongoConnection.
    • Scrubbed sensitive in-memory credentials immediately upon successful handshake / authentication.
    • Added secure on-demand credential re-hydration from ConnectionSecretsStore when reconnecting scrubbed instances.
  3. Tests:
    • Added unit tests in test/core/storage/secret_scrubbing_test.dart validating that credentials are scrubbed across connection models.

Closes #607

@github-actions github-actions Bot added enhancement New feature or request storage Theme parser epic label: storage labels Aug 26, 2026
@ZhuchkaTriplesix
ZhuchkaTriplesix merged commit bb81dac into dev Aug 26, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request storage Theme parser epic label: storage

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant