[GH-ISSUE #4117] Confidential Information is stored in plain text in the DB #1473

New issue

Closed

opened 2026-03-16 20:26:49 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 20:26:49 +03:00

Owner

Originally created by @Breee on GitHub (Jun 12, 2024).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4117

Is there an existing issue for this?

I have searched the existing issues

Summary

It's simple, confidential stuff like

public.Account.providerAccessToken (the JWT token of a user) is stored in plain text
MAILER_SMTP_URL is stored in plain text which can contain credentials
MICROSOFT_CLIENT_SECRET is stored in plain text, which, if someone uses a priviledged client for some reason , can wipe whole azure accounts in the wrong hands.

There are probably more cases like this and I don't like it.

Why should this be worked on?

if passwords are in plain text, the security would be compromised by anyone having a glance at it. simple

Originally created by @Breee on GitHub (Jun 12, 2024). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4117 ### Is there an existing issue for this? - [X] I have searched the existing issues ### Summary It's simple, confidential stuff like - `public.Account.providerAccessToken` (the JWT token of a user) is stored in plain text - `MAILER_SMTP_URL` is stored in plain text which can contain credentials - `MICROSOFT_CLIENT_SECRET` is stored in plain text, which, if someone uses a priviledged client for *some reason* , can wipe whole azure accounts in the wrong hands. There are probably more cases like this and I don't like it. ### Why should this be worked on? if passwords are in plain text, the security would be compromised by anyone having a glance at it. simple

kerem

2026-03-16 20:26:49 +03:00

closed this issue
added the
feature
label

kerem commented

2026-03-16 20:27:06 +03:00

Author

Owner

@mirarifhasan commented on GitHub (Oct 17, 2024):

Hi @Breee
Thanks for raising this concern! It has been addressed in PR #4212. I'm closing this issue as it is now resolved.

@mirarifhasan commented on GitHub (Oct 17, 2024): Hi @Breee Thanks for raising this concern! It has been addressed in PR #4212. I'm closing this issue as it is now resolved.

kerem referenced this issue

2026-03-17 00:57:26 +03:00

[PR #1473] [CLOSED] chore(deps): bump @nuxtjs/axios from 5.13.0 to 5.13.1 #3334