Integration: Secure API Keys and Webhook Secrets with HashiCorp Vault

[EDOHWARES]

Description

Migrate secrets storage (API keys, webhook signing secrets, database credentials) to HashiCorp Vault.

Current Problem

Sensitive keys and integration secrets are stored in MongoDB with symmetric encryption using static config keys, which are vulnerable to database leaks.

Proposed Solution

Integrate HashiCorp Vault transit secrets engine for dynamic encryption and secure key storage.

Technical Tasks

• Install and configure the `node-vault` client in the backend container
• Set up Vault transit keys and access control policies
• Refactor existing database encryption utilities to execute requests via Vault transit API
• Implement secure database credential rotation using Vault database engines

Acceptance Criteria

• Decryption of secrets requires authentication tokens not stored in the application database
• Secrets in database fields are encrypted via Vault and are not readable in plain text
• All access and decryption events are tracked in Vault audit logs

Testing Requirements

• Spin up Vault in dev mode and verify data encryption and retrieval processes

Metadata

• Priority: High
• Difficulty: High