# Security implications of exposed SSO Secret in multi-user install?

**URL:** <https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092>\
**Category:** WordPress\
**Created:** [2015 年5 月 21 日 20:39 UTC](https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092 "2015-05-21T20:39:00Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

作者： ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)\
发布日期： [2015 年5 月 21 日 22:38 UTC](https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092/2 "2015-05-21T22:38:55Z")

</div>

I was going to say “if you know that the secret is compromised, cycle it and move on”; but that doesn’t seem to apply here. Uh, I think the fix is to lock down who can see the plugin settings. Where would that be done? I’m not a WP expert.

---

_[View the full topic](https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092)._