From e9e4908d9eee992195281397c9f4621a02488714 Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Sat, 9 May 2026 15:48:21 -0500
Subject: [PATCH] Block patch on deleted secrets

---
 server/src/routes/secrets.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server/src/routes/secrets.ts b/server/src/routes/secrets.ts
index 6fe1b7ecf7e..cba2fe09d7b 100644
--- a/server/src/routes/secrets.ts
+++ b/server/src/routes/secrets.ts
@@ -348,6 +348,10 @@ export function secretRoutes(db: Db) {
       return;
     }
     assertCompanyAccess(req, existing.companyId);
+    if (existing.status === "deleted") {
+      res.status(404).json({ error: "Secret not found" });
+      return;
+    }
 
     const rotated = await svc.rotate(
       id,