# Credentials security vulnerability

**URL:** <https://discourse.nodered.org/t/credentials-security-vulnerability/90484>\
**Category:** General\
**Tags:** security\
**Created:** [27 August 2024 13:49 UTC](https://discourse.nodered.org/t/credentials-security-vulnerability/90484 "2024-08-27T13:49:21Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

**Author:** ![E1cid](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/e1cid/32/77971_2.png) [@E1cid](https://discourse.nodered.org/u/E1cid)\
**Post date:** [27 August 2024 15:05 UTC](https://discourse.nodered.org/t/credentials-security-vulnerability/90484/9 "2024-08-27T15:05:15Z")

</div>

Try adding a flow environment var credential and see if you can see it after you enter it and deploy. Then try exporting the flow and see if the credential is exported.

As soon as the flow is deployed the credential is encrypted by the server.

> [@Feature Request : Secured Template/Function node](https://discourse.nodered.org/t/feature-request-secured-template-function-node/88634/2):
>
> If you want a way to safely store credentials that the Function node can use, then you can add them as environment variables at the Group/Subflow/Flow/Global level (depending on how widely accessible you need them to be). The env vars can be stored as credentials (so they won't get exposed in the editor) and the Function node can use env.get('MY\_TOKEN') to retrieve the value. It wouldn't be practical to have a 'secure' function node in the way you describe as credential values never get returne…

[edit] I think we are communicating past each other , i am referring to flow, group and global env vars, not an enviroment file.

---

_[View the full topic](https://discourse.nodered.org/t/credentials-security-vulnerability/90484)._