Marc-André Bombeck 5ea17398bc feat(security): encrypt medication free-text notes at rest + password-change MFA step-up ...

Encrypt MedicationSideEffect.notes, MedicationDoseChange.note and
MedicationInventoryItem.notes with AES-256-GCM, closing the last plaintext
PHI columns left after the v1.23 note-encryption rollout. Add the three
*Encrypted Bytes columns (migration 0208), register them in the encrypted-
column rotation set, route every read/write through the note cipher, and add
a transactional fail-closed boot-time backfill for legacy rows. Plaintext
columns drop in a later release once the backfill reports zero remaining rows.

Require a fresh second factor on password change for MFA-enrolled accounts,
matching the existing step-up on MFA-disable and recovery-code regen. Redact
free-text note values from the Zod validation excerpt that can reach a wide
event.

2026-06-28 03:05:10 +02:00

..

__tests__

feat(security): encrypt medication free-text notes at rest + password-change MFA step-up

2026-06-28 03:05:10 +02:00

event-loop-lag.ts

feat(observability): every wide event carries the recent event-loop lag

2026-06-12 20:58:30 +02:00

redact-payload.ts

feat(security): encrypt medication free-text notes at rest + password-change MFA step-up

2026-06-28 03:05:10 +02:00