[misc] Remove default zitadel admin user in deployment script

[bcmmbaga]

Describe your changes

Issue ticket number and link

Stack

Checklist

• Is it a bug fix
• Is a typo/documentation fix
• Is a feature enhancement
• It is a refactor
• Created tests that fail without the change (if possible)

By submitting this pull request, you confirm that you have read and agree to the terms of the Contributor License Agreement.

Documentation

Select exactly one:

• I added/updated documentation for this change
• Documentation is not needed for this change (explain why)

Docs PR URL (required if "docs added" is checked)

Paste the PR link from https://github.com/netbirdio/docs here:

https://github.com/netbirdio/docs/pull/__

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull Request Overview

This PR adds functionality to remove the default zitadel-admin user during the Zitadel deployment script initialization process. This appears to be a security enhancement to clean up default administrative accounts after deployment.

• Adds a new function delete_default_zitadel_admin to search for and delete the default admin user
• Integrates the deletion step into the existing init_zitadel function workflow

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[stevo11811]

So, we kind of skimmed over the fact that anyone that used the getting-started-with-zitadel script could have an insecure admin account exposed, understandable that this is the users responsibility, but a note should be created stating the account should be removed.

[mlsmaycon]

So, we kind of skimmed over the fact that anyone that used the getting-started-with-zitadel script could have an insecure admin account exposed, understandable that this is the users responsibility, but a note should be created stating the account should be removed.

We are working on it. We need to check the impact and since when zitadel has had this setting enabled.

[CERT-PL-CNA]

We have reserved CVE-2025-10678 for that vulnerability. We will publish full CVE entry shortly.

[mlsmaycon]

We have reserved CVE-2025-10678 for that vulnerability. We will publish full CVE entry shortly.

@CERT-PL-CNA Why publish without discussing with us?

We still working with some folks.