{"action":"created","issue":{"url":"https://api.github.com/repos/metabase/metabase/issues/1148","repository_url":"https://api.github.com/repos/metabase/metabase","labels_url":"https://api.github.com/repos/metabase/metabase/issues/1148/labels{/name}","comments_url":"https://api.github.com/repos/metabase/metabase/issues/1148/comments","events_url":"https://api.github.com/repos/metabase/metabase/issues/1148/events","html_url":"https://github.com/metabase/metabase/issues/1148","id":110114507,"number":1148,"title":"SMTP password is stored in plaintext and can be accessed by admins (e.g. from the admin settings email page)","user":{"login":"tlrobinson","id":18193,"avatar_url":"https://avatars.githubusercontent.com/u/18193?v=3","gravatar_id":"","url":"https://api.github.com/users/tlrobinson","html_url":"https://github.com/tlrobinson","followers_url":"https://api.github.com/users/tlrobinson/followers","following_url":"https://api.github.com/users/tlrobinson/following{/other_user}","gists_url":"https://api.github.com/users/tlrobinson/gists{/gist_id}","starred_url":"https://api.github.com/users/tlrobinson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tlrobinson/subscriptions","organizations_url":"https://api.github.com/users/tlrobinson/orgs","repos_url":"https://api.github.com/users/tlrobinson/repos","events_url":"https://api.github.com/users/tlrobinson/events{/privacy}","received_events_url":"https://api.github.com/users/tlrobinson/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/metabase/metabase/labels/Help%20Wanted","name":"Help Wanted","color":"fad8c7"},{"url":"https://api.github.com/repos/metabase/metabase/labels/Security","name":"Security","color":"B11623"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2015-10-06T22:28:05Z","updated_at":"2016-10-18T01:49:55Z","closed_at":null,"body":"We should probably never allow users to see previously set credentials, and possibly encrypt them somehow."},"comment":{"url":"https://api.github.com/repos/metabase/metabase/issues/comments/254384418","html_url":"https://github.com/metabase/metabase/issues/1148#issuecomment-254384418","issue_url":"https://api.github.com/repos/metabase/metabase/issues/1148","id":254384418,"user":{"login":"salsakran","id":107439,"avatar_url":"https://avatars.githubusercontent.com/u/107439?v=3","gravatar_id":"","url":"https://api.github.com/users/salsakran","html_url":"https://github.com/salsakran","followers_url":"https://api.github.com/users/salsakran/followers","following_url":"https://api.github.com/users/salsakran/following{/other_user}","gists_url":"https://api.github.com/users/salsakran/gists{/gist_id}","starred_url":"https://api.github.com/users/salsakran/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/salsakran/subscriptions","organizations_url":"https://api.github.com/users/salsakran/orgs","repos_url":"https://api.github.com/users/salsakran/repos","events_url":"https://api.github.com/users/salsakran/events{/privacy}","received_events_url":"https://api.github.com/users/salsakran/received_events","type":"User","site_admin":false},"created_at":"2016-10-18T01:49:54Z","updated_at":"2016-10-18T01:49:54Z","body":"I think modifying `defsetting` to make some keys as `write-only` makes the most sense. \r\n\r\nIn-db encryption isn't a bad idea, and I'd guess that if we ever did #865 any settings that were `write-only` should also be protected."}}
{"actor":{"display_login":"salsakran"}}