Credentials security vulnerability

[E1cid]

Try adding a flow environment var credential and see if you can see it after you enter it and deploy. Then try exporting the flow and see if the credential is exported.

As soon as the flow is deployed the credential is encrypted by the server.

Feature Request : Secured Template/Function node

If you want a way to safely store credentials that the Function node can use, then you can add them as environment variables at the Group/Subflow/Flow/Global level (depending on how widely accessible you need them to be). The env vars can be stored as credentials (so they won't get exposed in the editor) and the Function node can use env.get('MY_TOKEN') to retrieve the value. It wouldn't be practical to have a 'secure' function node in the way you describe as credential values never get returne…

[edit] I think we are communicating past each other , i am referring to flow, group and global env vars, not an enviroment file.