Problem
Commit 5d8d16f (#467) introduced runtime placeholder secret validation that rejects known placeholder values for synthetic.secret_key and publisher.proxy_secret at startup. The expanded placeholder list and case-insensitive matching now catches deployments that were previously working fine.
Expected Behavior
Deployments that worked before #467 should continue to work. Secret validation should only check that values are non-empty, not reject specific known strings.
Decision
The team decided this should be a no-fix for now — remove the runtime placeholder checks entirely while keeping the existing non-empty validation.
Affected Files
crates/common/src/settings.rs — placeholder constants, detection methods, reject_placeholder_secrets()crates/common/src/settings_data.rs — runtime call to reject_placeholder_secrets()crates/common/src/error.rs — InsecureDefault error variantcrates/common/build.rs — comment about runtime deferraldocs/guide/configuration.md — placeholder rejection documentation
Problem
Commit 5d8d16f (#467) introduced runtime placeholder secret validation that rejects known placeholder values for
synthetic.secret_keyandpublisher.proxy_secretat startup. The expanded placeholder list and case-insensitive matching now catches deployments that were previously working fine.Expected Behavior
Deployments that worked before #467 should continue to work. Secret validation should only check that values are non-empty, not reject specific known strings.
Decision
The team decided this should be a no-fix for now — remove the runtime placeholder checks entirely while keeping the existing non-empty validation.
Affected Files
crates/common/src/settings.rs— placeholder constants, detection methods,reject_placeholder_secrets()crates/common/src/settings_data.rs— runtime call toreject_placeholder_secrets()crates/common/src/error.rs—InsecureDefaulterror variantcrates/common/build.rs— comment about runtime deferraldocs/guide/configuration.md— placeholder rejection documentation