A second lock on the modules the business can't lose
Per-module PIN protection whose recovery secret lives outside the database.
The problem a client brought us
“One person with admin rights accidentally uninstalled a module we depend on. We need a second lock on our most critical modules — one that even another admin can't casually bypass.”
Before and after
Who could remove a critical module
- Any admin
- Anyone with database access
What a reset now needs
A secret in the server config
What we found and built
Per-module PIN protection, independent of Odoo's normal permission system. The recovery secret lives in the server config file, not the database — so database access alone can't reset a lock, and the person the feature protects against can't also disable it.
The pattern behind it
Keep the off switch out of the threat's reach
A recovery secret that lives in the database protects nothing from a database administrator. Security settings and recovery secrets live in the server config instead, on both platforms.
How we think about problemsRecognise any of this?
Most of our work starts with a message that sounds a lot like this one did.