What does this MR do and why?

Removes unencrypted "value" column that duplicates encrypted field. Fixes #592747.

References

• Customer-reported issue
• Forum post
• (internal link) DataSec investigation isssue

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Brendan O'Connor (71a609b9) at 17 Mar 16:53

Brendan O'Connor (9c7e5b39) at 17 Mar 16:48

Just a couple of thoughts off the top of my head:

First, how can we utilize and expand the unit test suite to help ensure the redaction layer functions performantly and doesn't suffer regressions in the future? Do you have documentation on what the test suite covers currently vs what you'd like it to cover?

Secondly, I know you have a lot of existing test cases that are run outside the testing suite (e.g., that you've been using for smoke testing while coding); are those things we can automate and put into the pipeline?

What other areas would you like assistance with?

The profiles system is excellent, and a major addition to OpenBao that Vault doesn't support. I think that the document sets out all the benefits of the work quite well; in particular, enabling direct communication between OpenBao and other parts of GitLab without proxying through the Rails app reduces the attack surface (since Rails could MITM secrets at the moment) and increases the possibility space for what OpenBao/GLSM can do in the app. I'm excited to see where it goes!

Status Update - 2026-03-13

Achievements:

• No updates from this week.

Blockers:

Dependencies:

Next Steps:

Next update: 2026-03-20

Status Update - 2026-03-13

Achievements:

• Wrapped code review and provided a summary to Gus as part of his larger security work on GKG. No major security concerns found, but other findings that should be addressed as part of maintenance and expansion of GKG.
• Security signoff is due as of 2026-03-15 (Sunday), per GKG's announced schedule. Gus will take that.

Blockers:

Dependencies:

Next Steps:

Next update: 2026-03-20

Status Update - 2026-03-13

Achievements:

• No movement noted.

Blockers:

Dependencies:

Next Steps:

Next update: 2026-03-20