{"record":{"id":"47e8fd5e53ec021f","repo":"we-promise/sure","slug":"security-activerecord-encryption-is-not-configur","errorCode":null,"errorMessage":"[SECURITY] ActiveRecord Encryption is NOT configured. Sensitive data\n(API keys, provider/bank tokens, MFA secrets, and PII) are being stored\nUNENCRYPTED at rest. To enable encryption, set the following keys in your Rails credentials or environment variables:\n  ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY\n  ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY\n  ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT\nGenerate a set with: bin/rails db:encryption:init","messagePattern":"\\[SECURITY\\] ActiveRecord Encryption is NOT configured\\. Sensitive data\n\\(API keys, provider/bank tokens, MFA secrets, and PII\\) are being stored\nUNENCRYPTED at rest\\. To enable encryption, set the following keys in your Rails credentials or environment variables:\n  ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY\n  ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY\n  ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT\nGenerate a set with: bin/rails db:encryption:init","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/initializers/encryption_warning.rb","lineNumber":11,"sourceCode":"# frozen_string_literal: true\n\n# Warn self-hosted operators when ActiveRecord Encryption is NOT configured.\n#\n# This emits a clear startup warning so plaintext-at-rest is never silent.\nrequire Rails.root.join(\"lib/active_record_encryption_config\").to_s\n\nRails.application.config.after_initialize do\n  app_mode = Rails.application.config.app_mode\n  if app_mode.self_hosted? && !ActiveRecordEncryptionConfig.explicitly_configured?\n    Rails.logger.warn(<<~WARN)\n      [SECURITY] ActiveRecord Encryption is NOT configured. Sensitive data\n      (API keys, provider/bank tokens, MFA secrets, and PII) are being stored\n      UNENCRYPTED at rest. To enable encryption, set the following keys in your Rails credentials or environment variables:\n        ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY\n        ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY\n        ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT\n      Generate a set with: bin/rails db:encryption:init\n    WARN\n  end\nend\n","sourceCodeStart":1,"sourceCodeEnd":22,"githubUrl":"https://github.com/we-promise/sure/blob/e69894adb92547273377398c15f45c979cd9416a/config/initializers/encryption_warning.rb#L1-L22","documentation":"Not a raised exception but a startup log warning emitted by config/initializers/encryption_warning.rb (line 11) after_initialize when the app runs in self-hosted mode and ActiveRecordEncryptionConfig.explicitly_configured? is false — i.e. the three ACTIVE_RECORD_ENCRYPTION_* keys are absent. Provider models such as Trading212Item guard encrypts with encryption_ready?, so without keys, API keys, provider/bank tokens, MFA secrets and PII are stored in plaintext at rest. The warning exists so plaintext-at-rest is never silent.","triggerScenarios":"Booting the app (server, console, rake tasks) in self-hosted mode without ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY, ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY, or ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT set in env or credentials.","commonSituations":"Fresh self-hosted deploys (Docker compose, Kubernetes) missing the encryption env vars; adding the keys later and needing to re-encrypt existing plaintext columns; the hosted/SaaS mode never sees this warning because it is self_hosted?-gated.","solutions":["Generate keys with bin/rails db:encryption:init and set the three output values as environment variables, then restart.","Keep the keys stable afterward — rotating or losing them makes previously encrypted columns unreadable (deterministic columns are used for lookups like api_key).","For existing plaintext data written before enabling encryption, plan a one-time re-encryption (rotate! or rewrite the attributes) so rows are consistent.","Never commit the keys; use your secret manager / deployment env, matching .env.local.example patterns."],"exampleFix":"// before\n# env has no ACTIVE_RECORD_ENCRYPTION_* vars -> [SECURITY] warning at boot\n\n// after\n$ bin/rails db:encryption:init\n# set in deployment env:\nACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=...\nACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=...\nACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=...","handlingStrategy":"validation","validationCode":"required = %w[ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT]\nmissing = required.reject { |k| ENV[k].present? }\nabort \"missing encryption keys: #{missing.join(', ')}\" if missing.any? && Rails.application.config.app_mode.self_hosted?","typeGuard":"ActiveRecordEncryptionConfig.explicitly_configured?","tryCatchPattern":null,"preventionTips":["Generate keys once with bin/rails db:encryption:init and inject via secret manager; never rotate casually.","Add the three env vars to deployment checklists and .env.local.example-derived setup docs.","Watch boot logs for the [SECURITY] banner after deploys; its absence after adding keys is your confirmation."],"tags":["rails","security","encryption","self-hosted","startup-warning"],"backgroundTag":"encryption-not-configured","analyzedSha":"e69894adb92547273377398c15f45c979cd9416a","analyzedAt":"2026-08-21T18:22:41.165Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}