Skip to content

[Security] C-01: Plugin secrets stored in plaintext when encryption key is absent #44

Description

@xdevrobot

Severity: CRITICAL (OWASP A07:2021)

File: src/sdk/secrets.ts lines 124-128

When neither TELETON_SECRETS_KEY nor TELETON_WALLET_KEY is set, writePluginSecret() silently falls back to writing secrets as plaintext JSON to disk. This affects all plugin API keys, tokens, and credentials stored via /plugin set.

Note: wallet-service.ts already properly refuses to save wallet without encryption key (line 174-182), but secrets.ts does not follow the same pattern.

Impact: Any user with filesystem access can read all plugin secrets in plaintext. The 0o600 permission is insufficient in multi-user environments or when backups are exfiltrated.

Fix: Add requireEncryptionKey() function that throws if no key is configured, use it in writePluginSecret() and deletePluginSecret().

Part of comprehensive security audit.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions