Cron worker that blanks stored bodies of receipts whose event declares metadata: [sensitive_content: true].

The receipt-first pattern stores full rendered content, which for OTP codes and password-reset links means live secrets in the database. Once a receipt is older than config :ash_dispatch, :scrub_after_hours (default 24), its body_text is replaced with a marker and body_html cleared. Recipient, subject, status and delivery timestamps are untouched.

Receipts in :failed are skipped so the retry path can still resend the original content; they are scrubbed once they reach a terminal state.

Configuration

# On the event, in the dispatch DSL:
event(:password_reset,
  ...,
  metadata: [sensitive_content: true])

# Optional retention window (hours):
config :ash_dispatch, scrub_after_hours: 24

Scheduling

config :my_app, Oban,
  plugins: [
    {Oban.Plugins.Cron,
     crontab: [
       {"20 3 * * *", AshDispatch.Workers.ScrubSensitiveContent}
     ]}
  ]