GothenburgBitFactory / GothenburgBitFactory/bugwarrior

Store Trello API Key in Keyring

Open
#1,095 2 comments 0 reactions 0 assignees View on GitHub
feature proposal trello
Dominant language
Python
Stars
820
Forks
225
PR merge metrics
No merged PRs in 30d

Description

> Hello, what about Trello's API key, I've check the code and there is no use of `self.get_password` method. Is it bug or feature @ryneeverett? I'd personally said bug, because I'd rather not to expose any sensitive information. I would changed it, but I'm not sure about non-contributor PR's acceptance in this project.

_Originally posted by @JecminekTomas in [#1063](https://github.com/GothenburgBitFactory/bugwarrior/issues/1063#issuecomment-2908834345)_

From https://developer.atlassian.com/cloud/trello/guides/rest-api/api-introduction/:

> Because of the way the authorization flow works, the API key is intended to be publicly accessible. An API key by itself doesn't grant access to a user's Trello data. However, because API tokens grant access to the user's data, they should be kept secret.

I've read this paragraph 5 times and I can't quite make sense it. But it does seem reasonable to allow users to store their api key in their keyring if they think it ought to be treated like a secret since it doesn't impose any cost on anyone else.

> I would changed it, but I'm not sure about non-contributor PR's acceptance in this project.

PR's are welcome! According to Github we have 127 contributors. If there's anything more we should do to make it clear that PR's are welcome, please open a new issue to let us know.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.