# Initial Secret/Token Exposed in Plain Text in the Data File

**URL:** <https://forums.percona.com/t/initial-secret-token-exposed-in-plain-text-in-the-data-file/30855>\
**Category:** PG\_TDE – Transparent Data Encryption (TDE)\
**Created:** [June 6, 2024, 11:00pm UTC](https://forums.percona.com/t/initial-secret-token-exposed-in-plain-text-in-the-data-file/30855 "2024-06-06T23:00:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dwayne](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/dwayne/32/16799_2.png) [@dwayne](https://forums.percona.com/u/dwayne)\
**Post date:** [June 6, 2024, 11:00pm UTC](https://forums.percona.com/t/initial-secret-token-exposed-in-plain-text-in-the-data-file/30855/1 "2024-06-06T23:00:26Z")

</div>

Classic secret 0 problem

 ![CleanShot 2024-06-06 at 18.59.10@2x](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/0/8/082493c5da6e6ff29d59cb6fab1291c38de0452e.png)

The pg\_tde extension works like a charm on data at-rest encryption for the data files related to the tables created with “USING pg\_tde” - have some concerns about the lack of obfuscation/encryption for the token stored in the pg\_tde\_key\_provider table though.

---

<div class="post-metadata">

**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\
**Post date:** [June 7, 2024, 8:02pm UTC](https://forums.percona.com/t/initial-secret-token-exposed-in-plain-text-in-the-data-file/30855/2 "2024-06-07T20:02:10Z")

</div>

If the token itself is encrypted, then it would require user intervention to first decrypt the token to be usable by pgsql. The token file is intended to be protected at the OS level so that only the database process can access it. This is no different than storing your SSL cert key alongside the webserver config. You will want to integrate Vault for key storage if you are concerned about the security of the token file.

---

<div class="post-metadata">

**Author:** ![zsolt.parragi](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/zsolt.parragi/32/16648_2.png) [@zsolt.parragi](https://forums.percona.com/u/zsolt.parragi)\
**Post date:** [June 10, 2024, 7:25am UTC](https://forums.percona.com/t/initial-secret-token-exposed-in-plain-text-in-the-data-file/30855/3 "2024-06-10T07:25:40Z")

</div>

Please also take a look at our support for external parameters: [Use reference to external parameters - pg\_tde documentation](https://percona-lab.github.io/pg_tde/main/external-parameters.html)  
Which allows you to store the vault secret key anywhere else, in any way, and retrieve it using a http call, or using a file stored elsewhere.