Where does airbyte open source store credentials once they are entered in the UI?

Not 100% sure and would love to know it as well ,though by looking at the file structure and since it`s docker I would say as env in airbyte db image

@Eli Sigal I will DM you because it's a bit of a security issue

I agree we`ve implemented other measures in the code for that

I'm blown away that airbyte makes it so easy to download the system config file. No reason to even hide passwords when you can just go there

@Lucas Wiley we block access to the ability to download that system config file (blocked the API route it uses) - not a perfect solution of course, but sounds like you may want to think about doing that as well

Yes that is one alternative I discussed with @Eli Sigal as well. Thank you

Christ, good to know! Does anyone from Airbyte know why this is open by default via API? Any opposition to locking it down?

I will create an issue for that tomorrow. I think the larger solution is just making sure your airbyte service is protected from any potential access outside the local ssh tunnel and making it clearer in the airbyte docs for future users

Awesome thanks @Cam

Hi all, we hear you and will be improving our current documentation on how to better secure Airbyte within the next few weeks. Thanks for the feedback!

The credentials are masked within the config file in the latest versions of airbyte, older versions did not have this masking in place. Make sure you are up to date and test it out by exporting your config file in the settings page. Upgrading Airbyte: https://docs.airbyte.com/operator-guides/upgrading-airbyte/