mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads #13602

Closed
Bug
#13755
Closed
mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads#13602
Bug
#13755
Assignees
os-warren
Labels
domain:specpriority:p1High: required for production / M2security

Description

@os-warren
os-warren
opened on Aug 31, 2026

Found while implementing #13405 (nested credential positions off the passthrough table). That fix closes the class of nested positions that MIRROR a top-level credential spelling (password, authToken, and former aliases, judged at every object depth on both doors). It deliberately does NOT invent new secret NAMES: the client-measured residue stays passthroughSecretPaths in packages/spec/src/data/datasource-credential-redaction.ts, whose #9040 discipline is that every entry is measured against the client the driver spreads config.options into, never inferred from documentation.

The residue class has at least one more likely member family. The mongodb client's CSFLE surface reads secret material from the options passthrough at nested positions whose leaf names mirror no top-level credential spelling, so neither the name judgment nor the table covers them today:

  • options.autoEncryption.kmsProviders.aws.secretAccessKey (and sessionToken)
  • options.autoEncryption.kmsProviders.azure.clientSecret
  • options.autoEncryption.kmsProviders.gcp.privateKey
  • options.autoEncryption.kmsProviders.local.key

Mechanically true today (measured on the #13405 branch): redactDatasourceConfig('mongodb', ...) serves these positions back verbatim with no redactedKeys entry, because the leaf names are not credential-spelled and no table row names them.

What this card needs before any table edit: the #9040-style measurement against mongodb@7.5.0 (the pinned client) — does the client actually read these positions when spread from config.options (CSFLE requires the optional mongodb-client-encryption dependency, which may itself change the answer), and what does a redacted round-trip do to a working CSFLE config? Entries land on passthroughSecretPaths only with that measurement quoted, per the module docblock.

Not #13405's class (that card is the mirrored-spelling class, fixed by derivation); this is the client-measured-name residue the table exists for.

Metadata

Metadata

Assignees

Labels

domain:specpriority:p1High: required for production / M2security

Type

Bug

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
     blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

    Skip to content
    mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads #13602
    Closed
    Bug
    #13755
    Closed
    mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads#13602
    Bug
    #13755
    Assignees
    os-warren
    Labels
    domain:specpriority:p1High: required for production / M2security
    Description
    @os-warren
    os-warren
    opened on Aug 31, 2026
    Found while implementing #13405 (nested credential positions off the passthrough table). That fix closes the class of nested positions that MIRROR a top-level credential spelling (password, authToken, and former aliases, judged at every object depth on both doors). It deliberately does NOT invent new secret NAMES: the client-measured residue stays passthroughSecretPaths in packages/spec/src/data/datasource-credential-redaction.ts, whose #9040 discipline is that every entry is measured against the client the driver spreads config.options into, never inferred from documentation.
    The residue class has at least one more likely member family. The mongodb client's CSFLE surface reads secret material from the options passthrough at nested positions whose leaf names mirror no top-level credential spelling, so neither the name judgment nor the table covers them today:
    • options.autoEncryption.kmsProviders.aws.secretAccessKey (and sessionToken)
    • options.autoEncryption.kmsProviders.azure.clientSecret
    • options.autoEncryption.kmsProviders.gcp.privateKey
    • options.autoEncryption.kmsProviders.local.key
    Mechanically true today (measured on the #13405 branch): redactDatasourceConfig('mongodb', ...) serves these positions back verbatim with no redactedKeys entry, because the leaf names are not credential-spelled and no table row names them.
    What this card needs before any table edit: the #9040-style measurement against mongodb@7.5.0 (the pinned client) — does the client actually read these positions when spread from config.options (CSFLE requires the optional mongodb-client-encryption dependency, which may itself change the answer), and what does a redacted round-trip do to a working CSFLE config? Entries land on passthroughSecretPaths only with that measurement quoted, per the module docblock.
    Not #13405's class (that card is the mirrored-spelling class, fixed by derivation); this is the client-measured-name residue the table exists for.
    Metadata
    Metadata
    Assignees
    Labels
    domain:specpriority:p1High: required for production / M2security
    Type
    Bug
    Projects
    No projects
      Milestone
      No milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions
      
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

      Skip to content
      mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads #13602
      Closed
      Bug
      #13755
      Closed
      mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads#13602
      Bug
      #13755
      Assignees
      os-warren
      Labels
      domain:specpriority:p1High: required for production / M2security
      Description
      @os-warren
      os-warren
      opened on Aug 31, 2026
      Found while implementing #13405 (nested credential positions off the passthrough table). That fix closes the class of nested positions that MIRROR a top-level credential spelling (password, authToken, and former aliases, judged at every object depth on both doors). It deliberately does NOT invent new secret NAMES: the client-measured residue stays passthroughSecretPaths in packages/spec/src/data/datasource-credential-redaction.ts, whose #9040 discipline is that every entry is measured against the client the driver spreads config.options into, never inferred from documentation.
      The residue class has at least one more likely member family. The mongodb client's CSFLE surface reads secret material from the options passthrough at nested positions whose leaf names mirror no top-level credential spelling, so neither the name judgment nor the table covers them today:
      • options.autoEncryption.kmsProviders.aws.secretAccessKey (and sessionToken)
      • options.autoEncryption.kmsProviders.azure.clientSecret
      • options.autoEncryption.kmsProviders.gcp.privateKey
      • options.autoEncryption.kmsProviders.local.key
      Mechanically true today (measured on the #13405 branch): redactDatasourceConfig('mongodb', ...) serves these positions back verbatim with no redactedKeys entry, because the leaf names are not credential-spelled and no table row names them.
      What this card needs before any table edit: the #9040-style measurement against mongodb@7.5.0 (the pinned client) — does the client actually read these positions when spread from config.options (CSFLE requires the optional mongodb-client-encryption dependency, which may itself change the answer), and what does a redacted round-trip do to a working CSFLE config? Entries land on passthroughSecretPaths only with that measurement quoted, per the module docblock.
      Not #13405's class (that card is the mirrored-spelling class, fixed by derivation); this is the client-measured-name residue the table exists for.
      Metadata
      Metadata
      Assignees
      Labels
      domain:specpriority:p1High: required for production / M2security
      Type
      Bug
      Projects
      No projects
        Milestone
        No milestone
        Relationships
        None yet
        Development
        No branches or pull requests
        Issue actions
        
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

        Skip to content
        mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads #13602
        Closed
        Bug
        #13755
        Closed
        mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads#13602
        Bug
        #13755
        Assignees
        os-warren
        Labels
        domain:specpriority:p1High: required for production / M2security
        Description
        @os-warren
        os-warren
        opened on Aug 31, 2026
        Found while implementing #13405 (nested credential positions off the passthrough table). That fix closes the class of nested positions that MIRROR a top-level credential spelling (password, authToken, and former aliases, judged at every object depth on both doors). It deliberately does NOT invent new secret NAMES: the client-measured residue stays passthroughSecretPaths in packages/spec/src/data/datasource-credential-redaction.ts, whose #9040 discipline is that every entry is measured against the client the driver spreads config.options into, never inferred from documentation.
        The residue class has at least one more likely member family. The mongodb client's CSFLE surface reads secret material from the options passthrough at nested positions whose leaf names mirror no top-level credential spelling, so neither the name judgment nor the table covers them today:
        • options.autoEncryption.kmsProviders.aws.secretAccessKey (and sessionToken)
        • options.autoEncryption.kmsProviders.azure.clientSecret
        • options.autoEncryption.kmsProviders.gcp.privateKey
        • options.autoEncryption.kmsProviders.local.key
        Mechanically true today (measured on the #13405 branch): redactDatasourceConfig('mongodb', ...) serves these positions back verbatim with no redactedKeys entry, because the leaf names are not credential-spelled and no table row names them.
        What this card needs before any table edit: the #9040-style measurement against mongodb@7.5.0 (the pinned client) — does the client actually read these positions when spread from config.options (CSFLE requires the optional mongodb-client-encryption dependency, which may itself change the answer), and what does a redacted round-trip do to a working CSFLE config? Entries land on passthroughSecretPaths only with that measurement quoted, per the module docblock.
        Not #13405's class (that card is the mirrored-spelling class, fixed by derivation); this is the client-measured-name residue the table exists for.
        Metadata
        Metadata
        Assignees
        Labels
        domain:specpriority:p1High: required for production / M2security
        Type
        Bug
        Projects
        No projects
          Milestone
          No milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

          Skip to content
          mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads #13602
          Closed
          Bug
          #13755
          Closed
          mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads#13602
          Bug
          #13755
          Assignees
          os-warren
          Labels
          domain:specpriority:p1High: required for production / M2security
          Description
          @os-warren
          os-warren
          opened on Aug 31, 2026
          Found while implementing #13405 (nested credential positions off the passthrough table). That fix closes the class of nested positions that MIRROR a top-level credential spelling (password, authToken, and former aliases, judged at every object depth on both doors). It deliberately does NOT invent new secret NAMES: the client-measured residue stays passthroughSecretPaths in packages/spec/src/data/datasource-credential-redaction.ts, whose #9040 discipline is that every entry is measured against the client the driver spreads config.options into, never inferred from documentation.
          The residue class has at least one more likely member family. The mongodb client's CSFLE surface reads secret material from the options passthrough at nested positions whose leaf names mirror no top-level credential spelling, so neither the name judgment nor the table covers them today:
          • options.autoEncryption.kmsProviders.aws.secretAccessKey (and sessionToken)
          • options.autoEncryption.kmsProviders.azure.clientSecret
          • options.autoEncryption.kmsProviders.gcp.privateKey
          • options.autoEncryption.kmsProviders.local.key
          Mechanically true today (measured on the #13405 branch): redactDatasourceConfig('mongodb', ...) serves these positions back verbatim with no redactedKeys entry, because the leaf names are not credential-spelled and no table row names them.
          What this card needs before any table edit: the #9040-style measurement against mongodb@7.5.0 (the pinned client) — does the client actually read these positions when spread from config.options (CSFLE requires the optional mongodb-client-encryption dependency, which may itself change the answer), and what does a redacted round-trip do to a working CSFLE config? Entries land on passthroughSecretPaths only with that measurement quoted, per the module docblock.
          Not #13405's class (that card is the mirrored-spelling class, fixed by derivation); this is the client-measured-name residue the table exists for.
          Metadata
          Metadata
          Assignees
          Labels
          domain:specpriority:p1High: required for production / M2security
          Type
          Bug
          Projects
          No projects
            Milestone
            No milestone
            Relationships
            None yet
            Development
            No branches or pull requests
            Issue actions
            
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

            Skip to content
            mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads #13602
            Closed
            Bug
            #13755
            Closed
            mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads#13602
            Bug
            #13755
            Assignees
            os-warren
            Labels
            domain:specpriority:p1High: required for production / M2security
            Description
            @os-warren
            os-warren
            opened on Aug 31, 2026
            Found while implementing #13405 (nested credential positions off the passthrough table). That fix closes the class of nested positions that MIRROR a top-level credential spelling (password, authToken, and former aliases, judged at every object depth on both doors). It deliberately does NOT invent new secret NAMES: the client-measured residue stays passthroughSecretPaths in packages/spec/src/data/datasource-credential-redaction.ts, whose #9040 discipline is that every entry is measured against the client the driver spreads config.options into, never inferred from documentation.
            The residue class has at least one more likely member family. The mongodb client's CSFLE surface reads secret material from the options passthrough at nested positions whose leaf names mirror no top-level credential spelling, so neither the name judgment nor the table covers them today:
            • options.autoEncryption.kmsProviders.aws.secretAccessKey (and sessionToken)
            • options.autoEncryption.kmsProviders.azure.clientSecret
            • options.autoEncryption.kmsProviders.gcp.privateKey
            • options.autoEncryption.kmsProviders.local.key
            Mechanically true today (measured on the #13405 branch): redactDatasourceConfig('mongodb', ...) serves these positions back verbatim with no redactedKeys entry, because the leaf names are not credential-spelled and no table row names them.
            What this card needs before any table edit: the #9040-style measurement against mongodb@7.5.0 (the pinned client) — does the client actually read these positions when spread from config.options (CSFLE requires the optional mongodb-client-encryption dependency, which may itself change the answer), and what does a redacted round-trip do to a working CSFLE config? Entries land on passthroughSecretPaths only with that measurement quoted, per the module docblock.
            Not #13405's class (that card is the mirrored-spelling class, fixed by derivation); this is the client-measured-name residue the table exists for.
            Metadata
            Metadata
            Assignees
            Labels
            domain:specpriority:p1High: required for production / M2security
            Type
            Bug
            Projects
            No projects
              Milestone
              No milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

              Skip to content
              mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads #13602
              Closed
              Bug
              #13755
              Closed
              mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads#13602
              Bug
              #13755
              Assignees
              os-warren
              Labels
              domain:specpriority:p1High: required for production / M2security
              Description
              @os-warren
              os-warren
              opened on Aug 31, 2026
              Found while implementing #13405 (nested credential positions off the passthrough table). That fix closes the class of nested positions that MIRROR a top-level credential spelling (password, authToken, and former aliases, judged at every object depth on both doors). It deliberately does NOT invent new secret NAMES: the client-measured residue stays passthroughSecretPaths in packages/spec/src/data/datasource-credential-redaction.ts, whose #9040 discipline is that every entry is measured against the client the driver spreads config.options into, never inferred from documentation.
              The residue class has at least one more likely member family. The mongodb client's CSFLE surface reads secret material from the options passthrough at nested positions whose leaf names mirror no top-level credential spelling, so neither the name judgment nor the table covers them today:
              • options.autoEncryption.kmsProviders.aws.secretAccessKey (and sessionToken)
              • options.autoEncryption.kmsProviders.azure.clientSecret
              • options.autoEncryption.kmsProviders.gcp.privateKey
              • options.autoEncryption.kmsProviders.local.key
              Mechanically true today (measured on the #13405 branch): redactDatasourceConfig('mongodb', ...) serves these positions back verbatim with no redactedKeys entry, because the leaf names are not credential-spelled and no table row names them.
              What this card needs before any table edit: the #9040-style measurement against mongodb@7.5.0 (the pinned client) — does the client actually read these positions when spread from config.options (CSFLE requires the optional mongodb-client-encryption dependency, which may itself change the answer), and what does a redacted round-trip do to a working CSFLE config? Entries land on passthroughSecretPaths only with that measurement quoted, per the module docblock.
              Not #13405's class (that card is the mirrored-spelling class, fixed by derivation); this is the client-measured-name residue the table exists for.
              Metadata
              Metadata
              Assignees
              Labels
              domain:specpriority:p1High: required for production / M2security
              Type
              Bug
              Projects
              No projects
                Milestone
                No milestone
                Relationships
                None yet
                Development
                No branches or pull requests
                Issue actions
                
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

                Skip to content
                mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads #13602
                Closed
                Bug
                #13755
                Closed
                mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads#13602
                Bug
                #13755
                Assignees
                os-warren
                Labels
                domain:specpriority:p1High: required for production / M2security
                Description
                @os-warren
                os-warren
                opened on Aug 31, 2026
                Found while implementing #13405 (nested credential positions off the passthrough table). That fix closes the class of nested positions that MIRROR a top-level credential spelling (password, authToken, and former aliases, judged at every object depth on both doors). It deliberately does NOT invent new secret NAMES: the client-measured residue stays passthroughSecretPaths in packages/spec/src/data/datasource-credential-redaction.ts, whose #9040 discipline is that every entry is measured against the client the driver spreads config.options into, never inferred from documentation.
                The residue class has at least one more likely member family. The mongodb client's CSFLE surface reads secret material from the options passthrough at nested positions whose leaf names mirror no top-level credential spelling, so neither the name judgment nor the table covers them today:
                • options.autoEncryption.kmsProviders.aws.secretAccessKey (and sessionToken)
                • options.autoEncryption.kmsProviders.azure.clientSecret
                • options.autoEncryption.kmsProviders.gcp.privateKey
                • options.autoEncryption.kmsProviders.local.key
                Mechanically true today (measured on the #13405 branch): redactDatasourceConfig('mongodb', ...) serves these positions back verbatim with no redactedKeys entry, because the leaf names are not credential-spelled and no table row names them.
                What this card needs before any table edit: the #9040-style measurement against mongodb@7.5.0 (the pinned client) — does the client actually read these positions when spread from config.options (CSFLE requires the optional mongodb-client-encryption dependency, which may itself change the answer), and what does a redacted round-trip do to a working CSFLE config? Entries land on passthroughSecretPaths only with that measurement quoted, per the module docblock.
                Not #13405's class (that card is the mirrored-spelling class, fixed by derivation); this is the client-measured-name residue the table exists for.
                Metadata
                Metadata
                Assignees
                Labels
                domain:specpriority:p1High: required for production / M2security
                Type
                Bug
                Projects
                No projects
                  Milestone
                  No milestone
                  Relationships
                  None yet
                  Development
                  No branches or pull requests
                  Issue actions