~/.heroku/credentials not hashed. about legacy-cli HOT 8 CLOSED

I just discovered that the Heroku gem does this. It says in the Readme that if you're on a Mac your credentials will be stored in your keychain, otherwise they will be stored in plain text in your ~/heroku directory.

I have a ~/.heroku directory that contains my credentials in plain text AND I'm on a mac... What's going on here? Anyone that has access to my computer can do whatever they please to my Heroku applications? no thanks...

from legacy-cli.

+1 keychain is not being used and this is not good

from legacy-cli.

+1 I was shocked when I discovered this. Immediately removed the file. Guess I'll just delete it after each deploy and then reenter my credentials the next time until this is fixed!

from legacy-cli.

+1 I just discovered this file and am very surprised. Password in plaintext? At the very least, the docs at http://docs.heroku.com/quickstart should reflect this. Please make a change so that passwords aren't stored in plaintext!

from legacy-cli.

it should be also fixed on other platforms and not just mac :)

from legacy-cli.

I further agree that credentials (especially the password) should not be stored in plaintext! Maybe make it an option to have the heroku gem remember your credentials instead of being the default behavior? Nevertheless, thanks for a wonderful product!

from legacy-cli.

If the goal is ease of use while maintaining security, please just store the username and require the password to be entered each time. As an interesting thought, please also support using SSH keys for all Heroku API operations, not just for git push.

from legacy-cli.

We're moving over to API keys. Delete your ~/.heroku/credentials file and run any command to reauthenticate.

from legacy-cli.