[GH-ISSUE #619] config.json -- storing plain text? #417

New issue

Closed

opened 2026-03-03 01:28:54 +03:00 by kerem · 2 comments

kerem commented

2026-03-03 01:28:54 +03:00

Owner

Originally created by @moranbw on GitHub (Sep 12, 2019).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/619

Does it matter that we are storing the admin_token and smtp_password as plain text in the config.json? Should the permissions of this file be by default more restrictive?

More asking then suggesting. I guess this still does not necessarily expose a user's vault, which is the main thing.

Originally created by @moranbw on GitHub (Sep 12, 2019). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/619 Does it matter that we are storing the admin_token and smtp_password as plain text in the config.json? Should the permissions of this file be by default more restrictive? More asking then suggesting. I guess this still does not necessarily expose a user's vault, which is the main thing.

kerem closed this issue

2026-03-03 01:28:54 +03:00

kerem commented

2026-03-03 01:28:55 +03:00

Author

Owner

@mprasil commented on GitHub (Sep 13, 2019):

You can set the permissions of the file yourself - as long as the container user can read and write to it, it should work fine.

You can also provide these as environment variables and you can the work out yourself how to set them in secure manner.

@mprasil commented on GitHub (Sep 13, 2019): You can set the permissions of the file yourself - as long as the container user can read and write to it, it should work fine. You can also provide these as environment variables and you can the work out yourself how to set them in secure manner.

kerem commented

2026-03-03 01:28:55 +03:00

Author

Owner

@mprasil commented on GitHub (Sep 30, 2019):

I'm going to close this one as there are multiple ways to provide the credentials without storing them in config.json and the permissions on the file itself can be set in any way as long as the service can read it and write to it. Feel free to reopen, if there's anything more we can do regarding this.

@mprasil commented on GitHub (Sep 30, 2019): I'm going to close this one as there are multiple ways to provide the credentials without storing them in config.json and the permissions on the file itself can be set in any way as long as the service can read it and write to it. Feel free to reopen, if there's anything more we can do regarding this.