nexxo 99b7393361 Stop committing a real password, and say the truth about what carried over ... MailboxSeedMigrationTest.php had the actual .env MAIL_PASSWORD for no-reply@clupilot.com hard-coded into a test fixture — replaced with an obvious dummy. Grepped the whole branch (576cfca..HEAD) and the working tree for that string and for every other real secret value in .env; nothing else leaked. Separately, the seed migration's SECRETS_KEY-missing warning claimed a password "was NOT copied into the mailbox table" even when a vault row already existed and its ciphertext WAS carried across a few lines below, unconditionally on $canEncrypt. An operator debugging a live mail outage would have been sent to re-enter a password that was already sitting in the column. The warning now distinguishes the two cases and says which one actually happened.		2026-07-28 03:49:37 +02:00
..
factories	Reuse the existing UUID trait instead of a second copy of the logic	2026-07-27 21:31:39 +02:00
migrations	Stop committing a real password, and say the truth about what carried over	2026-07-28 03:49:37 +02:00
seeders	Give the demo account a real password, not one written in the source	2026-07-27 17:09:54 +02:00
.gitignore	chore: bootstrap CluPilot control-plane (Laravel 13, Docker stack)	2026-07-25 00:21:30 +02:00