Api Key Exposure in Rails with Postgresql

In a Ruby on Rails application using Postgresql as the database, API keys often reside in server-side configuration, environment files, or within application logs and error traces. When Rails loads configuration from config/database.yml or environment variables, developers sometimes store or reference secrets in ways that Postgresql interactions can inadvertently expose. For example, if Rails logs full SQL statements including values bound to queries, sensitive API keys embedded in parameters may appear in Postgresql logs or monitoring tools. Additionally, using Rails ActiveRecord queries that interpolate raw values into SQL strings can lead to information leakage through error messages returned by Postgresql when invalid keys or malformed requests are processed.

Another exposure path is through Rails views or JSON APIs that serialize database records. If a Postgresql column stores an API key or token and a Rails model or controller includes that column in a serialized response (even accidentally via as_json or ActiveModel serializers), the key can be transmitted to clients or captured by browser developer tools. This is common when legacy schemas include credential columns or when debugging columns are left in production migrations. Postgresql’s type system and Rails’ dynamic model attributes can make it difficult to track which columns contain secrets, especially when keys are stored as plaintext or weakly encrypted strings.

Furthermore, background jobs and scheduled tasks in Rails that use Postgresql connections may log job arguments or exception backtraces containing API keys. If the Rails app uses gems that interact directly with Postgresql for auditing or caching, those interactions might retain key material in temporary tables or session state. Because Rails encourages convention-over-configuration, developers might not realize that certain default behaviors—such as logging all queries or enabling detailed error pages—can turn Postgresql into an unintended channel for API key exposure.

To reduce API key exposure in Rails with Postgresql, start by ensuring sensitive columns are never included in query results or serialized output. Use Postgresql column-level permissions and Rails model scopes to exclude sensitive fields. For example, define a Rails scope that explicitly selects only safe columns:

class ApiKeyRecord < ApplicationRecord
  # Prevent accidental serialization of sensitive columns
  def as_json(options = {})
    super(options.merge(only: [:id, :name, :created_at]))
  end
end

In your database schema, avoid storing API keys in plaintext. If you must store keys in Postgresql, use encrypted columns and manage decryption only in secure server-side contexts. With Rails and Postgresql, you can use pgcrypto extension for encryption at rest. Enable it via migration and store encrypted values:

class EnablePgcryptoAndStoreApiKey < ActiveRecord::Migration[7.0]
  def change
    enable_extension 'pgcrypto' unless extension_enabled?('pgcrypto')

    change_table :services do |t|
      t.string :encrypted_api_key
    end
  end
end

When inserting or reading encrypted keys, use Arel or raw SQL with Postgresql functions to avoid exposing values in logs. For example, insert encrypted values using pgp_sym_encrypt and decrypt only when necessary inside a secure service object:

class ApiKeyService
  def self.store_key(service_id, key)
    ApplicationRecord.connection.execute(
      "UPDATE services SET encrypted_api_key = pgp_sym_encrypt('#{key}', ENV['SECRET_KEY_BASE']) WHERE id = #{service_id}"
    )
  end

  def self.retrieve_key(service_id)
    result = ApplicationRecord.connection.select_one(
      "SELECT pgp_sym_decrypt(encrypted_api_key::bytea, '#{ENV['SECRET_KEY_BASE']}') AS api_key FROM services WHERE id = #{service_id}"
    )
    result['api_key'] if result
  end
end

Additionally, configure Rails and your Postgresql adapter to suppress sensitive data in logs. In config/environments/production.rb, set config.log_level = :warn and avoid logging full queries with parameters. Use the filter_parameters directive to ensure API keys are masked in Rails logs:

# config/initializers/filter_parameter_logging.rb
Rails.application.config.filter_parameters += [:api_key, :access_token, :secret]

Finally, audit your Postgresql queries and Rails code for any dynamic SQL that interpolates values. Prefer parameterized queries via ActiveRecord or sanitized Arel constructs to prevent keys from appearing in query strings or error traces returned by Postgresql.