Your issue titles are encrypted at rest
GitGumbo mirrors your issues so it can render a board without hammering your provider on every page load. That mirror includes issue titles, and issue titles are, by some distance, the most revealing thing in our database. "Fix the login loop" is harmless. Plenty of real ones are not.
Until now they sat in Postgres as plaintext, and — the part that actually mattered — they left the machine that way every night in the backup.
What changed
Titles are encrypted in the database. The application encrypts on write and decrypts on read, so the values in the table are ciphertext.
The nightly backup is encrypted too, independently. A backup is a copy of your data that lives somewhere else by design, which makes it the copy most worth protecting and the one easiest to forget. We have run a restore drill against the encrypted backups to confirm they are not merely encrypted but actually recoverable — an untested backup is a belief, not a backup.
The old plaintext columns have been dropped, not just left unused. A column nobody reads is still a column that is there, still in every dump, still one careless query away from being read again.
Why it took four deploys
Dropping a column in a live system is not one change, it is two. For the length of a deploy, the previously-deployed code is running against the newly-migrated schema. So a migration that removes something the running code still expects takes the site down in the gap.
The safe shape is expand, then contract: add the new columns and write to both, move reads across, stop writing the old ones, and only then — in a later deploy, once nothing running refers to them — drop them. Four steps, four deploys, no window in which the code and the schema disagree.
The interesting part was finding every reader. It is tempting to grep for the column name and conclude that nothing references it, but that is a claim about your source code when the thing that matters is the generated SQL. Prisma projects every scalar field on a model unless you explicitly narrow the selection, so seven query sites were reading those columns without ever naming them. A single-deploy contract phase would have taken out four write paths.
What this is not
This is encryption at rest, and it is honest to be precise about what that covers. It protects the data in the database file and in the backups. It does not make us unable to read your issue titles — the application decrypts them to draw your board, which is the whole point of the board. If you need a provider that cannot read your data at all, that is a different product than this one.