Encryption-at-rest guide says rotating the SSE-KMS key re-encrypts existing model files; KMS key rotation does not re-encrypt stored objects (F-W1-DOCS-TRUST-19)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 55/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- aws
- Domain
- documentation, security
Research direction
The wrong claim is in docs/qms/encryption_at_rest.md around lines 92-95, where it says rotation makes model files re-encrypt at the storage layer, and the same passage appears in docs/qms/encryption_at_rest-tr.md around lines 94-97. Read the AWS KMS rotation page linked in the issue, then separate scheduled rotation (new writes only) from re-encryption by copying objects under the new key. Done when both language versions say rotation does not re-encrypt existing artefacts, state how re-encryption is done and how long old key material is kept, and link the provider procedure.
Written by the indexing model from the issue text.
Description
Wave 3 · group W3 Docs · highest severity Medium · 1 finding(s) · effort docs fix
Summary
The guide says ForgeLM is unaffected by key rotation because "the model files re-encrypt at the storage layer". AWS KMS key rotation only changes the key material used for new encryption; it keeps the earlier material to decrypt existing ciphertext and does not re-encrypt stored data. An operator who rotates after a suspected key exposure would believe old model files are protected by new key material when they are not.
Primary finding
F-W1-DOCS-TRUST-19 — KMS rotation is incorrectly said to re-encrypt existing model files
severity Medium · confidence high · checked against the AWS KMS documentation
What happens. docs/qms/encryption_at_rest.md:92-95 (Turkish mirror docs/qms/encryption_at_rest-tr.md:94-97): "rotate the CMK itself, not just the data key. ForgeLM is unaffected by rotation — the model files re-encrypt at the storage layer without the training pipeline noticing." Objects already written with SSE-KMS stay encrypted under the data keys they were written with, protected by the earlier key material; moving them to new key material means re-encrypting them, for example by copying the objects.
Where.
Evidence (re-verified on 2026-10-09).
- AWS KMS developer guide, "Rotate AWS KMS keys": rotation changes the key material used for new cryptographic operations, KMS keeps the earlier key material to decrypt data encrypted under it, and rotating key material does not re-encrypt the data the key protects (https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html).
- Both pages are unchanged on
development.
Recommended fix. Separate the two operations. Scheduled key rotation protects new writes; existing artefacts stay readable and are not re-encrypted. Re-encrypting existing artefacts — after a suspected key compromise, or where a policy requires it — is a separate step (copy the objects under the new key) and the old key material must stay available until the copy and a restore test are verified. Link the provider's procedure instead of promising transparent re-encryption.
Acceptance criteria
- Neither page states or implies that key rotation re-encrypts existing model files.
- The guide says how existing artefacts are re-encrypted and how long the old key material is kept.
- Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
- The finding is resolved or explicitly closed with a reason.
Found by the September 2026 independent review of ForgeLM against commit cab2947 and re-verified against development at f94595f on 2026-10-09. Code links point at cab2947; line numbers may have moved since. Finding IDs (F-W1-…) are stable references for this backlog.
- Dominant language
- Python
- Stars
- 9
- Forks
- 1
- Avg merge
- 8h 10m
- Merged PRs (30d)
- 5
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from HodeTech/ForgeLM
-
area: dev-tooling bug severity: low source: roadmap wave: 4
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Site: the theme-locked --code-comment grey (#6a6f80) on the dark code surface is 3.8:1, below WCAG AA, in both themes (F-W1-SITE-06)Possibly taken @vortsghost2025 claimed this today. Openarea: site bug good first issue severity: low source: review-2026-09 wave: 4
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
-
documentation good first issue severity: medium source: review-2026-09 wave: 3
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
documentation good first issue severity: low source: review-2026-09 wave: 4
Difficulty 1/5 1-3 hours Newbie friendliness 80/100
-
documentation severity: medium source: review-2026-09 wave: 3
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
All issues in HodeTech/ForgeLM
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
task
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
danparshall/claude_researcher#87 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
datajoint/datajoint-python#1586 ·
Maintainers usually reply within 1 day
-
1D intercept of length 1 is accepted as `fix_params` in population GLM with more than 1 unitPossibly taken @dhvani7014 claimed this today. Openbug good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
flatironinstitute/nemos#642 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
uniswap-python/uniswap-python#487 ·