Friday, August 21, 2026
1 change · 19.0
Security fixes and vulnerability patches
The database creation wizard no longer exposes sensitive API keys in readable form. This protects customer credentials while preserving the ability to create databases from templates with the correct key.
Original PR description
This commit is a follow-up to 8741c123997438beb56fa065667b431616c809a5 which hardens the security of the `database_api_key` field on `project.project`. The issue is that a similar field is still accessible on the wizard allowing the creation of a database from a template, `project.template.create.wizard`. With this commit, the field is masked in the same way. A test checks that the key cannot be read in cleartext from the ORM any more, and that the database creation still initialize the correct key.