Rotate Authentik secrets exposed during ideahunter recon #2

New issue

Open

opened 2026-07-12 23:25:39 +00:00 by frank · 0 comments

frank commented

2026-07-12 23:25:39 +00:00

Owner

What happened

During 2026-07-12 recon for the ideahunter.fmrdigital.dev deployment, a subagent ran docker exec authentik-server env on fmrdigital (100.119.88.80) to inspect Authentik's provider config. This dumped plaintext secrets into that agent's own transcript. Nothing was transmitted externally, but per the mandatory secret-leak-prevention policy these count as exposed and should be rotated.

Exposed values (rotate these)

AUTHENTIK_EMAIL__PASSWORD (Resend SMTP key)
AUTHENTIK_BOOTSTRAP_TOKEN
AUTHENTIK_SECRET_KEY
AUTHENTIK_POSTGRESQL__PASSWORD
AUTHENTIK_BOOTSTRAP_PASSWORD

Owner

User (Frank) opted to handle rotation personally rather than have it done as part of the ideahunter session � filed here so it doesn't get lost. This affects the shared Authentik instance used by all fmrdigital.dev apps, not just this project.

See also: decisions/2026-07-12-ideahunter-auth-architecture.md in this repo for full context.

## What happened During 2026-07-12 recon for the ideahunter.fmrdigital.dev deployment, a subagent ran `docker exec authentik-server env` on fmrdigital (100.119.88.80) to inspect Authentik's provider config. This dumped plaintext secrets into that agent's own transcript. Nothing was transmitted externally, but per the mandatory secret-leak-prevention policy these count as exposed and should be rotated. ## Exposed values (rotate these) - `AUTHENTIK_EMAIL__PASSWORD` (Resend SMTP key) - `AUTHENTIK_BOOTSTRAP_TOKEN` - `AUTHENTIK_SECRET_KEY` - `AUTHENTIK_POSTGRESQL__PASSWORD` - `AUTHENTIK_BOOTSTRAP_PASSWORD` ## Owner User (Frank) opted to handle rotation personally rather than have it done as part of the ideahunter session � filed here so it doesn't get lost. This affects the shared Authentik instance used by all fmrdigital.dev apps, not just this project. See also: `decisions/2026-07-12-ideahunter-auth-architecture.md` in this repo for full context.