Senders API returns SMTP passwords and SES secret keys to every project member #30

New issue

Closed

opened 2026-10-15 01:18:27 -04:00 by vmanne-poc · 0 comments

vmanne-poc commented

2026-10-15 01:18:27 -04:00

Owner

Bug (security). GET /projects/:id/senders returns each sender's full config object, which includes the SMTP pass and the SES secretAccessKey. Every project member can read them, and so can anything that has a member's token.

Fix

Never return secrets.
- The API returns config without pass and secretAccessKey.
- It adds hasPassword / hasSecret flags, so the UI can show whether a secret is set.
- This applies to every route that returns a sender.
Secrets stay write-only: they can be set or replaced (in Phase 10, when senders become editable) but never read back.
Separate follow-up: encrypt secrets at rest with a server key (POSTAK_SECRET_KEY).

Done when

An e2e test shows no secret appears in any sender response.

**Bug (security).** `GET /projects/:id/senders` returns each sender's full `config` object, which includes the SMTP `pass` and the SES `secretAccessKey`. Every project member can read them, and so can anything that has a member's token. **Fix** - Never return secrets. - The API returns `config` without `pass` and `secretAccessKey`. - It adds `hasPassword` / `hasSecret` flags, so the UI can show whether a secret is set. - This applies to every route that returns a sender. - Secrets stay write-only: they can be set or replaced (in Phase 10, when senders become editable) but never read back. - Separate follow-up: encrypt secrets at rest with a server key (`POSTAK_SECRET_KEY`). **Done when** - An e2e test shows no secret appears in any sender response.

vmanne-poc added this to the Phase 9.5: Project workspace UI milestone

2026-10-15 01:18:27 -04:00

vmanne-poc added the

security

bug

labels

2026-10-15 01:18:27 -04:00

vmanne-poc referenced this issue from a commit

2026-10-15 07:43:31 -04:00

Never return sender passwords or secret keys

vmanne-poc referenced this issue from a pull request that will close it,

2026-10-15 07:48:49 -04:00