537b8758ff541a88731d391d3ac6a1b02fd09221
auth_providers was missing from ScopedCollections, so reap.go's scopedCollectionsForPurge() (derived from that list) never deleted an instance's providers, leaving orphaned rows holding encrypted client secrets forever. Verified migration 0004's $rename over org_id->instance_id is a no-op here since auth_providers never carried org_id.
Description
No description provided
9.7 MiB
Languages
JavaScript
63.9%
Go
19.3%
TypeScript
16.6%