#6065 `meltano invoke` writes passwords into temporary config files during execution Issue created by DouweM Meltano encourages you to manage passwords and other sensitive configuration using environment variables (or

.env

) so they don't end up checked into the repo, but does write these passwords down into the file system when generating the config files for Singer taps/targets, Airflow, or Superset (as of #6031). They'll also show up in

meltano invoke --dump=config <plugin>

, as that returns the exact file that's passed to the plugin in question. These files are cleaned up once

meltano invoke

completes (which is why

--daemon

flags don't work: #3440), but are still as long-living as your web UI or scheduler. This has potential security implications. Since the

superset_config.py

config file we generate for Superset can contain arbitrary code, we could read the values from the environment variables there instead of hard-coding them into the file. This is not an option with Airflow or Singer, as

airflow.cfg

and

config.json

are simple serialized dictionaries. meltano/meltano