Severity: CRITICAL (OWASP A07:2021)
File: src/sdk/secrets.ts lines 124-128
When neither TELETON_SECRETS_KEY nor TELETON_WALLET_KEY is set, writePluginSecret() silently falls back to writing secrets as plaintext JSON to disk. This affects all plugin API keys, tokens, and credentials stored via /plugin set.
Note: wallet-service.ts already properly refuses to save wallet without encryption key (line 174-182), but secrets.ts does not follow the same pattern.
Impact: Any user with filesystem access can read all plugin secrets in plaintext. The 0o600 permission is insufficient in multi-user environments or when backups are exfiltrated.
Fix: Add requireEncryptionKey() function that throws if no key is configured, use it in writePluginSecret() and deletePluginSecret().
Part of comprehensive security audit.
Severity: CRITICAL (OWASP A07:2021)
File: src/sdk/secrets.ts lines 124-128
When neither TELETON_SECRETS_KEY nor TELETON_WALLET_KEY is set, writePluginSecret() silently falls back to writing secrets as plaintext JSON to disk. This affects all plugin API keys, tokens, and credentials stored via /plugin set.
Note: wallet-service.ts already properly refuses to save wallet without encryption key (line 174-182), but secrets.ts does not follow the same pattern.
Impact: Any user with filesystem access can read all plugin secrets in plaintext. The 0o600 permission is insufficient in multi-user environments or when backups are exfiltrated.
Fix: Add requireEncryptionKey() function that throws if no key is configured, use it in writePluginSecret() and deletePluginSecret().
Part of comprehensive security audit.