we-promise/sure · warning

[SECURITY] ActiveRecord Encryption is NOT configured. Sensit

Error message

[SECURITY] ActiveRecord Encryption is NOT configured. Sensitive data
(API keys, provider/bank tokens, MFA secrets, and PII) are being stored
UNENCRYPTED at rest. To enable encryption, set the following keys in your Rails credentials or environment variables:
  ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY
  ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY
  ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT
Generate a set with: bin/rails db:encryption:init

What it means

Not a raised exception but a startup log warning emitted by config/initializers/encryption_warning.rb (line 11) after_initialize when the app runs in self-hosted mode and ActiveRecordEncryptionConfig.explicitly_configured? is false — i.e. the three ACTIVE_RECORD_ENCRYPTION_* keys are absent. Provider models such as Trading212Item guard encrypts with encryption_ready?, so without keys, API keys, provider/bank tokens, MFA secrets and PII are stored in plaintext at rest. The warning exists so plaintext-at-rest is never silent.

Source

Thrown at config/initializers/encryption_warning.rb:11

# frozen_string_literal: true

# Warn self-hosted operators when ActiveRecord Encryption is NOT configured.
#
# This emits a clear startup warning so plaintext-at-rest is never silent.
require Rails.root.join("lib/active_record_encryption_config").to_s

Rails.application.config.after_initialize do
  app_mode = Rails.application.config.app_mode
  if app_mode.self_hosted? && !ActiveRecordEncryptionConfig.explicitly_configured?
    Rails.logger.warn(<<~WARN)
      [SECURITY] ActiveRecord Encryption is NOT configured. Sensitive data
      (API keys, provider/bank tokens, MFA secrets, and PII) are being stored
      UNENCRYPTED at rest. To enable encryption, set the following keys in your Rails credentials or environment variables:
        ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY
        ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY
        ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT
      Generate a set with: bin/rails db:encryption:init
    WARN
  end
end

View on GitHub (pinned to e69894adb9)

Solutions

1. Generate keys with bin/rails db:encryption:init and set the three output values as environment variables, then restart.
2. Keep the keys stable afterward — rotating or losing them makes previously encrypted columns unreadable (deterministic columns are used for lookups like api_key).
3. For existing plaintext data written before enabling encryption, plan a one-time re-encryption (rotate! or rewrite the attributes) so rows are consistent.
4. Never commit the keys; use your secret manager / deployment env, matching .env.local.example patterns.

Example fix

// before
# env has no ACTIVE_RECORD_ENCRYPTION_* vars -> [SECURITY] warning at boot

// after
$ bin/rails db:encryption:init
# set in deployment env:
ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=...
ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=...
ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=...

required = %w[ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT]
missing = required.reject { |k| ENV[k].present? }
abort "missing encryption keys: #{missing.join(', ')}" if missing.any? && Rails.application.config.app_mode.self_hosted?

ActiveRecordEncryptionConfig.explicitly_configured?

When it happens

Trigger: Booting the app (server, console, rake tasks) in self-hosted mode without ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY, ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY, or ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT set in env or credentials.

Common situations: Fresh self-hosted deploys (Docker compose, Kubernetes) missing the encryption env vars; adding the keys later and needing to re-encrypt existing plaintext columns; the hosted/SaaS mode never sees this warning because it is self_hosted?-gated.

Related errors

• [SSL] WARNING: SSL verification is DISABLED
• Auth config not loaded: #{e.class} - #{e.message}
• Sophtron provider is not configured
• record_not_found
• validation_failed

AI-assisted analysis of we-promise/sure@e69894adb9 (2026-08-21). Data as JSON: /api/errors/47e8fd5e53ec021f. Report an issue: GitHub.