SA-2026-032: Drain passphrases derive from a key the server also sees

What it is

The lane key pair's passphrase and enum key are derived from the vault's write key, which is also sent to the vault server, and the endpoint comes from a file in the vault.

What an attacker could do

The server, or anyone logging its headers, holds the passphrase.

How: Public in outline.

Root cause

Deriving from the nearest key rather than from the client-only secret.

What was not in place

Derive from the part of the key that never leaves the client.

What would fix it

Derive from the vault key's secret part; pin the endpoint.