# SMTP Password saved as plain text?

**URL:** <https://meta.discourse.org/t/smtp-password-saved-as-plain-text/144220>\
**Category:** Self-hosting\
**Created:** [March 13, 2020, 1:58pm UTC](https://meta.discourse.org/t/smtp-password-saved-as-plain-text/144220 "2020-03-13T13:58:35Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![MidwestJay](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@MidwestJay](https://meta.discourse.org/u/MidwestJay)\
**Post date:** [March 13, 2020, 1:58pm UTC](https://meta.discourse.org/t/smtp-password-saved-as-plain-text/144220/1 "2020-03-13T13:58:36Z")

</div>

Hi,

I am new to installing Discourse, and recently set it up on a Digital Ocean Droplet for us as our company forum/community page.

During the install, I noticed the SMTP password entry is not protected, and it is stored as plain text in the app.yml file.

That seems like a potential security issue. However, I am not a networking/security expert, so this may be just fine for a number of reasons. But in order to keep our IT Manager happy, it would help me if I can better understand why it’s done this way.

I know Discourse is widely used by many companies, so I suspect that this topic has been sufficiently addressed already.

Any help is appreciated.

Thanks!  
Jason

---

_[View the full topic](https://meta.discourse.org/t/smtp-password-saved-as-plain-text/144220)._