Currently, we store a range's private key in plaintext in the database. This is problematic because if the database were to get dumped by an attacker, they would have direct access to all deployed customer infrastructure.
To fix this, I think we should leverage the same or similar encryption scheme that we use for cloud secrets where we use the user's cookies to decrypt the private key when the user triggers requests that require SSH access into the range.
Currently, we store a range's private key in plaintext in the database. This is problematic because if the database were to get dumped by an attacker, they would have direct access to all deployed customer infrastructure.
To fix this, I think we should leverage the same or similar encryption scheme that we use for cloud secrets where we use the user's cookies to decrypt the private key when the user triggers requests that require SSH access into the range.