cloudflare / cloudflare/cloudflare-docs
Local Secrets Store secrets are persisted in plaintext on disk
- Dominant language
- MDX
- Stars
- 5.2k
- Forks
- 16.7k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 337
Description
### What versions & operating system are you using?
Wrangler: 4.70.0
Operating system: macOS
### Please provide a link to a minimal reproduction
https://github.com/orelbn/cloudflare-local-secrets-store-plaintext-repro
### Describe the Bug
Local-only Secrets Store secrets created without `--remote` are persisted in plaintext on disk.
I expected local Secrets Store secrets to either:
1. be encrypted at rest locally, or
2. be clearly documented as plaintext-accessible local development state
Right now, the local persistence behavior appears to store secret values in plaintext under `.wrangler/state`.
### Reproduction
Minimal reproduction repo:
https://github.com/orelbn/cloudflare-local-secrets-store-plaintext-repro
From the repo root, run:
```bash
wrangler secrets-store secret create test-store \
--name TEST_SECRET \
--value 'UNIQUE_CF_SECRET_9d3f4b6e' \
--scopes workers
```
```bash
rg -n 'UNIQUE_CF_SECRET_9d3f4b6e' .wrangler/state
```
Actual behavior
The plaintext secret value is found in the local persisted files under .wrangler/state.
Expected behavior
Either:
* local-only Secrets Store secrets should be encrypted at rest locally, or
* the docs should explicitly state that local-only Secrets Store persistence is not encrypted and should not be treated as a secure local vault
Relevant documentation:
[Manage account secrets](https://developers.cloudflare.com/secrets-store/manage-secrets/)
### Please provide any relevant error logs
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.