We're already doing this for OIDC and Git auth tokens, so yes! We'll do this too.

I didn't see the passphrase configuration in the documentation (perhaps I looked too quickly).
Where is it stored?

Ahh, apologies! We're working on this now... it's not out yet!

Related #7640

We added support to encrypt sensitive fields in the database, requires an enterprise license though

We added support to encrypt sensitive fields in the database, requires an enterprise license though

@sreya, If security is only reserved for users with enterprise license, this can be a very bad signal for the open-source community.

@Adphi could you share more about the use case?

We reserve key-rotation for encrypting database values in the Enterprise because this has only been necessary for our Enterprise customers. And necessary is even a stretch in that scenario, it's more of a nice-to-have from our understanding.

@kylecarbs, as soon as sensitive data is stored in a database, it should to be encrypted. If an unencrypted backup is compromised, or if the database server is compromised, this would expose identifiers enabling (potentially privileged) access to private repositories.

When using an encryption key, you also need to plan for its rotation in the event that it is compromised.

Grafana, for example, encrypts credentials used to access datasources, even if a default key is used when not configured.