fix(boost): address round-3 security findings

- Guard isSensitiveField against unknown DB keys (nil-deref)
- Wrap JSON.parse in try/catch in getOverride/getAllOverrides
- Warn at startup when encrypted DB values exist without encryptionSecret

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: gabemontero

workspaces/boost/plugins/boost-backend/src/config/AdminConfigService.ts

@@ -125,7 +125,15 @@ export class AdminConfigService {
       return undefined;
     }
 
-    let rawValue: unknown = JSON.parse(row.value);
+    let rawValue: unknown;
+    try {
+      rawValue = JSON.parse(row.value);
+    } catch {
+      this.logger.error(
+        `Corrupt value for config key "${key}" — skipping (invalid JSON)`,
+      );
+      return undefined;
+    }
 
     // Decrypt sensitive fields
     if (isSensitiveField(key) && typeof rawValue === 'string') {
@@ -152,7 +160,15 @@ export class AdminConfigService {
     const result = new Map<string, unknown>();
 
     for (const row of rows) {
-      let rawValue: unknown = JSON.parse(row.value);
+      let rawValue: unknown;
+      try {
+        rawValue = JSON.parse(row.value);
+      } catch {
+        this.logger.error(
+          `Corrupt value for config key "${row.key}" — skipping (invalid JSON)`,
+        );
+        continue;
+      }
 
       // Decrypt sensitive fields
       const key = row.key as BoostConfigKey;
@@ -267,6 +283,14 @@ export class AdminConfigService {
         continue;
       }
 
+      // Warn at startup if sensitive fields exist but cannot be decrypted
+      if (isSensitiveField(key) && !this.encryptionSecret) {
+        this.logger.warn(
+          `Sensitive config override "${key}" exists in DB but no encryption secret is configured — ` +
+            `this field will be unreadable at runtime. Set boost.encryptionSecret to restore access.`,
+        );
+      }
+
       // Re-validate the stored value
       try {
         let rawValue: unknown = JSON.parse(row.value);

workspaces/boost/plugins/boost-backend/src/config/schemas.ts

@@ -200,5 +200,6 @@ export function isDbWritable(key: BoostConfigKey): boolean {
  * @public
  */
 export function isSensitiveField(key: BoostConfigKey): boolean {
-  return (boostConfigFields[key] as ConfigFieldMeta).sensitive === true;
+  const field = boostConfigFields[key] as ConfigFieldMeta | undefined;
+  return field?.sensitive === true;
 }