Is it safe to store sensitive data in environment variables? (e.g. apiKey)
- Dominant language
- TypeScript
- Stars
- 40k
- Forks
- 2.4k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 61
Description
In our system there is a custom authentication method which is similar to Amazon’s AWS4 authentication but not the same.
That is why we would like to create a plugin which will be able to do the authentication process providing sensitive data by the environment variables.
As we see the environment variables are stored in `insomnia.Environment.db` file on the filesystem without any encryption.
Is it safe enough or is there a safer way to set and store for example an apiKey inside Insomnia?
I've only found an example where the documentation recommends to use environment variables for apiKey.
https://support.insomnia.rest/article/18-environment-variables
Thank you for your answers in advance.
Contributor guide
Research direction
Start by reviewing the documented environment-variable guidance and inspecting Insomnia.Environment.db to confirm how values are stored. Compare that behavior with the requested custom authentication and plugin use case; done would require an agreed safer storage mechanism and corresponding security guidance.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100