search

frencojobs / vscode-notion

Browse Notion pages right inside Visual Studio Code.
https://marketplace.visualstudio.com/items?itemName=frenco.vscode-notion
MIT License
327 stars 15 forks source link

Credentials stored in plaintext #12

Open fiserdav opened 3 years ago

fiserdav commented 3 years ago

Dear developer,

Recently we conducted a VS code extension audit to review coding practices, making sure we’re using the latest technologies available focused on security. During this review, we identified a security issue inside your extension where credentials are stored as plaintext.

Back in January of this year, VSCode introduced API for secrets storage keystrokes in to save the secrets. Please take a moment to read through this API in order to understand how to enhance the extension security.

Any questions, please feel free to ask and I’ll be happy to help!

frencojobs commented 3 years ago

Thanks for filing an issue. This won't be needed if I migrated this to the official Notion API. Until then I don't have a plan to fix this since it is already hacky to get the token from Notion, fixing this won't be much of a help.