537b8758ff541a88731d391d3ac6a1b02fd09221
auth_providers was missing from ScopedCollections, so reap.go's scopedCollectionsForPurge() (derived from that list) never deleted an instance's providers, leaving orphaned rows holding encrypted client secrets forever. Verified migration 0004's $rename over org_id->instance_id is a no-op here since auth_providers never carried org_id.
Languages
JavaScript
63.8%
Go
19.4%
TypeScript
16.6%