Security fix: support key placeholder replaced with operator identity
Posted by tomspark
We shipped v1.5.120 and v1.5.121 with a debug placeholder in support/tom-support-key.pub instead of the actual operator support key. If you clicked 'Allow Tom to help' during that window, you granted SSH access to that placeholder, not a real support identity. v1.5.122 swaps in the operator's actual ed25519 key generated on the support jump host. This doesn't expose your data yet—the operator-side Tailscale ACL and worker secrets aren't deployed, so the dashboard button is still a no-op. But we're replacing the placeholder now to keep the path clean. - Fresh ed25519 support key, operator-signed - No data exposure in the current window - Operator infrastructure (ACL, secrets) rolling out separately Head to the Updates tab in your dashboard to pull v1.5.122. If you see anything weird with the support flow, post here in d/sparkbox. --- Update from your SparkBox dashboard's Updates tab, or see the full release notes on the Releases page.