Merge pull request #104 from telemetryflow/alert-autofix-39

zeroc0d3 · web-flow · commit 13583d06abcf · 2026-05-25T12:47:02.000+07:00
Potential fix for code scanning alert no. 39: Use of password hash with insufficient computational effort
diff --git a/backend/src/modules/api-keys/infrastructure/persistence/seeds/01-DefaultApiKeysSeed.ts b/backend/src/modules/api-keys/infrastructure/persistence/seeds/01-DefaultApiKeysSeed.ts
@@ -319,7 +319,9 @@ export class DefaultApiKeysSeed extends BaseSeed {
         continue;
       }
 
-      const apiKeySecret = crypto.createHash("sha256").update(key.api_key_secret_raw).digest("hex");
+      const secretSalt = crypto.randomBytes(16).toString("hex");
+      const secretHash = crypto.scryptSync(key.api_key_secret_raw, secretSalt, 64).toString("hex");
+      const apiKeySecret = `scrypt$${secretSalt}$${secretHash}`;
       const keyHint = key.api_key_secret_raw.slice(-4);
 
       // Encrypt the per-key encryption key with platform ENCRYPTION_KEY

Original file line number	Diff line number	Diff line change
`@@ -319,7 +319,9 @@ export class DefaultApiKeysSeed extends BaseSeed {`
`319`	`319`	`continue;`
`320`	`320`	`}`
`321`	`321`
`322`		`- const apiKeySecret = crypto.createHash("sha256").update(key.api_key_secret_raw).digest("hex");`
	`322`	`+ const secretSalt = crypto.randomBytes(16).toString("hex");`
	`323`	`+ const secretHash = crypto.scryptSync(key.api_key_secret_raw, secretSalt, 64).toString("hex");`
	`324`	+ const apiKeySecret = `scrypt$${secretSalt}$${secretHash}`;
`323`	`325`	`const keyHint = key.api_key_secret_raw.slice(-4);`
`324`	`326`
`325`	`327`	`// Encrypt the per-key encryption key with platform ENCRYPTION_KEY`