Add warning that default config storage is not for production use

Created on 11 August 2025, 8 days ago

Problem/Motivation

The recipe currently uses the Config key storage by default, which stores API credentials directly in the database. While this is a viable solution for proof-of-concepts and development environments, it poses security risks for production deployments where credentials should not be stored in the active configuration that gets exported and versioned.

Production environments require more secure credential storage methods to prevent sensitive information from being inadvertently exposed through configuration exports, version control, or database backups.

Steps to reproduce

Proposed resolution

  1. Add a prominent warning in the recipe documentation and/or post-install messaging that the default configuration storage is not suitable for production environments
  2. Provide clear guidance on how to change the key provider to a more secure option (such as Environment variable or File storage) after applying the recipe
  3. Consider adding recipe input options in future versions to allow users to specify the desired key storage method during installation

Potential future enhancement: Add a recipe input parameter to switch between "config" and "env" storage providers, where the environment variable option would require setting an environment variable before or after the recipe is applied.

Remaining tasks

User interface changes

API changes

Data model changes

Feature request
Status

Active

Version

1.1

Component

Code

Created by

🇭🇺Hungary mxr576 Hungary

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024