# SMTP Password saved as plain text?

**URL:** <https://meta.discourse.org/t/smtp-password-saved-as-plain-text/144220>\
**Category:** Self-hosting\
**Created:** [March 13, 2020, 1:58pm UTC](https://meta.discourse.org/t/smtp-password-saved-as-plain-text/144220 "2020-03-13T13:58:35Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![justin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/justin/32/157614_2.png) [@justin](https://meta.discourse.org/u/justin)\
**Post date:** [March 13, 2020, 3:01pm UTC](https://meta.discourse.org/t/smtp-password-saved-as-plain-text/144220/4 "2020-03-13T15:01:14Z")

</div>

> [@pfaffman](#):
>
> If someone your don’t trust has access to your app.yml file your smtp password is the least of your worries.

As Jay said, if someone gets access to your app.yml, you have other problems. That means they likely have full root access to your server including your production database.

The best practice here would be making sure your server is secure.

---

_[View the full topic](https://meta.discourse.org/t/smtp-password-saved-as-plain-text/144220)._