search

fleetdm / fleet

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)
https://fleetdm.com
Other
3.16k stars 432 forks source link

Encrypt and obfuscate calendar JSON API key #18095

Open dherder opened 7 months ago

dherder commented 7 months ago

Problem

As an endpoint operator who configured Fleet in your calendar, I want the contents of the Google Workspace service account secret to be obfuscated so that I can demo Fleet in your calendar w/o having to worry about exposing the secret.

noahtalerman commented 7 months ago

Thanks for tracking this @dherder. I updated the user story in the issue description to include the following as the "so that":

...so that I can demo Fleet in your calendar w/o having to worry about exposing the secret.

Let me know what you think.

getvictor commented 4 months ago

I'm expanding this story to include DB encryption. We recently encrypted many MDM assets in the DB, so it makes sense to include this API key as well. I'm also adding the engineering-initiated tag since this improves security.