docs(mcp): state which adversary at-rest encryption stops #126

Merged

Claude-Run merged 1 commit from docs/YT-66-at-rest-adversary-statement into main

2026-07-17 20:35:08 +02:00

Claude-Run commented

2026-07-17 20:33:06 +02:00

Member

The multi-user yt mcp serve service encrypts each account's YouTrack permanent token and TOTP secret under YOUTRACK_MCP_MASTER_KEY, but the deployment guide described only the mechanics and never stated the threat model. This epic's settled decision is that the encryption is an authorization boundary in the application and explicitly not cryptographic isolation from a host-root administrator, and that no doc may claim more than that. Add a "Which adversary the at-rest encryption stops" paragraph to the Local accounts section: it protects the data at rest against a leaked database, a stolen backup, or another account reading rows through the app, but not against host root or a party with docker exec, because the master key lives in the server process environment. Reference YT-64, which tracks strengthening that boundary.

#YT-66

The multi-user `yt mcp serve` service encrypts each account's YouTrack permanent token and TOTP secret under `YOUTRACK_MCP_MASTER_KEY`, but the deployment guide described only the mechanics and never stated the threat model. This epic's settled decision is that the encryption is an authorization boundary in the application and explicitly not cryptographic isolation from a host-root administrator, and that no doc may claim more than that. Add a "Which adversary the at-rest encryption stops" paragraph to the Local accounts section: it protects the data at rest against a leaked database, a stolen backup, or another account reading rows through the app, but not against host root or a party with `docker exec`, because the master key lives in the server process environment. Reference YT-64, which tracks strengthening that boundary. #YT-66

Claude-Run added 1 commit

2026-07-17 20:33:06 +02:00

docs(mcp): state which adversary at-rest encryption stops

Check / fmt + clippy + build + tests (pull_request) Successful in 1m9s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

87b139b5a6

The multi-user `yt mcp serve` service encrypts each account's YouTrack permanent token and TOTP secret under `YOUTRACK_MCP_MASTER_KEY`, but the deployment guide described only the mechanics and never stated the threat model. This epic's settled decision is that the encryption is an authorization boundary in the application and explicitly not cryptographic isolation from a host-root administrator, and that no doc may claim more than that. Add a "Which adversary the at-rest encryption stops" paragraph to the Local accounts section: it protects the data at rest against a leaked database, a stolen backup, or another account reading rows through the app, but not against host root or a party with `docker exec`, because the master key lives in the server process environment. Reference YT-64, which tracks strengthening that boundary.

#YT-66