search

nylas / sync-engine

:incoming_envelope: IMAP/SMTP sync system with modern APIs
https://nylas.com/docs/platform
GNU Affero General Public License v3.0
3.5k stars 354 forks source link

Passwords in database are in clear text #440

Closed scottix closed 7 years ago

scottix commented 7 years ago

Problem Passwords are stored in clear text

Steps to reproduce inbox-auth account login to mysql database SELECT * FROM secrets; Password for email shown in clear text

Expected Encrypted password in database

pfista commented 7 years ago

Thanks for reporting this. As per our readme:

For the sake of simplicity and setup speed, the development VM does not include any authentication or permission. For developing with sensitive data, we encourage developers to add their own protection, such as only running Nylas on a local machine or behind a controlled firewall. Note that passwords and OAuth tokens are stored unencrypted in the local MySQL data store on disk. This is intentional, for the same reason as above.