Is there any sensitive data in the Configuration Management Export?

Question

I noticed in default.settings.php this comment:

Location of the site configuration files.

The $config_directories array specifies the location of file system directories used for configuration data. On install, "active" and "staging" directories are created for configuration. The staging directory is used for configuration imports; the active directory is not used by default, since the default storage for active configuration is the database rather than the file system (this can be changed; see "Active configuration settings" below).

The default location for the active and staging directories is inside a randomly-named directory in the public files path; this setting allows you to override these locations. If you use files for the active configuration, you can enhance security by putting the active configuration outside your document root.

And then the example:

$config_directories = array(
  CONFIG_ACTIVE_DIRECTORY => '/some/directory/outside/webroot',
  CONFIG_STAGING_DIRECTORY => '/another/directory/outside/webroot',
);

I also noticed that when you export to the directory you specify, an .htaccess file is added that denies access to the directory.

I understand that most people will not want their configuration available for anyone to read, but what if your site is in a public repository?

https://github.com/davidbarratt/davidwbarratt/tree/develop/config

Is there anything I should be concerned about? Could this data be used to exploit the site?

Answer 1

Well, it contains the complete configuration, like list of modules, views, roles and their permissions.

While those things are not directly sensitive, it would make it easy to check for misconfigurations for example, views that aren't access protected, roles that have administrative permissions and so on.

I'm not sure if core adds anything that is explictly sensitive in there, I don't know any examples.

It does depend on the modules you have installed though. Many sites store API Keys or passwords, when integrating with third party services. Those would also be stored in configuration. For example configuration to send mails through an SMTP server or username/password for a Solr server. And you don't want to have that public.

But you probably also don't want those in git in the first place. You can solve that by setting them through configuration overrides in settings.php.