The environments document on the platform site holds every environment's credentials. Those secrets can now be stored encrypted, so reading the database directly no longer shows them, and Platform Configuration Values no longer reveals or exports them unless someone asks to see them. This prepares the estate for Head office taking ownership.
\nEncryption only happens where ENVIRONMENTS_ENCRYPTION_KEY is set. The key lives on the platform site's Fly app, in the GitHub Actions secrets and in a developer's server/.env, and nowhere else. When the platform site starts with the key, it encrypts anything still stored in the clear once its startup migrations have finished. Identifiers such as hosts, database names, usernames and app names stay readable, so the inventory works without decrypting. System Logins notes are encrypted too.
\nA document is only stored if decrypting it gives back exactly the original. If the key is missing where encrypted values are found, or is the wrong key, the error says so rather than reporting a missing configuration.
\nRemove the key from the platform site first, then run ngx-cli environments-decrypt --confirm with the key available. The document is stored with its secrets unencrypted again, and the command checks that what it wrote matches.
\n"}