Skip to content

[PM-31684] Remove email hashing for send access#6945

Open
itsadrago wants to merge 16 commits intomainfrom
tools/pm-31684/remove-email-hashing
Open

[PM-31684] Remove email hashing for send access#6945
itsadrago wants to merge 16 commits intomainfrom
tools/pm-31684/remove-email-hashing

Conversation

@itsadrago
Copy link
Contributor

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-31684

📔 Objective

Based on a discussion with the KM team and AppSec, we will no longer store an encrypted list of email address hashes for Send Access functionality. Instead, we will only encrypt a list of email addresses associated with a send instance. The hashing as implemented was adding no marked benefit and complicating the design

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

@github-actions
Copy link
Contributor

github-actions bot commented Feb 4, 2026

Logo
Checkmarx One – Scan Summary & Detailsa5fd414e-5812-4b57-b985-f3584bfdb048

New Issues (1)

Checkmarx found the following issues in this Pull Request

# Severity Issue Source File / Package Checkmarx Insight
1 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 291
detailsMethod at line 291 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
Fixed Issues (1)

Great job! The following issues were fixed in this Pull Request

Severity Issue Source File / Package
MEDIUM CSRF /src/Api/Tools/Controllers/SendsController.cs: 68

@codecov
Copy link

codecov bot commented Feb 4, 2026

Codecov Report

❌ Patch coverage is 53.33333% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.21%. Comparing base (ef37f3d) to head (f590631).

Files with missing lines Patch % Lines
...ucture.Dapper/Tools/Repositories/SendRepository.cs 25.00% 4 Missing and 2 partials ⚠️
...ls/SendFeatures/Queries/SendAuthenticationQuery.cs 66.66% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #6945      +/-   ##
==========================================
+ Coverage   56.25%   60.21%   +3.96%     
==========================================
  Files        1976     1976              
  Lines       87525    87520       -5     
  Branches     7809     7809              
==========================================
+ Hits        49238    52704    +3466     
+ Misses      36459    32899    -3560     
- Partials     1828     1917      +89     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@itsadrago itsadrago marked this pull request as ready for review February 4, 2026 20:41
@itsadrago itsadrago requested review from a team as code owners February 4, 2026 20:41
ike-kottlowski
ike-kottlowski previously approved these changes Feb 4, 2026
harr1424
harr1424 previously approved these changes Feb 4, 2026
rkac-bw
rkac-bw previously approved these changes Feb 5, 2026
Copy link
Contributor

@rkac-bw rkac-bw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@itsadrago itsadrago dismissed stale reviews from rkac-bw and harr1424 via 73a7155 February 5, 2026 16:08
Copy link
Contributor

@rkac-bw rkac-bw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants