(maven-site) branch encryption-obfuscation-note-12811 created (now e8fa6816)

[sl...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

slachiewicz pushed a change to branch encryption-obfuscation-note-12811
in repository https://gitbox.apache.org/repos/asf/maven-site.git


      at e8fa6816 Document the obfuscation-grade nature of Maven 3.x password encryption (gh-12811)

This branch includes the following new commits:

     new e8fa6816 Document the obfuscation-grade nature of Maven 3.x password encryption (gh-12811)

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(maven-site) 01/01: Document the obfuscation-grade nature of Maven 3.x password encryption (gh-12811)

[sl...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

slachiewicz pushed a commit to branch encryption-obfuscation-note-12811
in repository https://gitbox.apache.org/repos/asf/maven-site.git

commit e8fa68163f3407b3d3e96f22fba655d75cdc69ba
Author: Sylwester Lachiewicz <sl...@apache.org>
AuthorDate: Fri Aug 28 11:38:38 2026 +0200

    Document the obfuscation-grade nature of Maven 3.x password encryption (gh-12811)
---
 content/markdown/guides/mini/guide-encryption.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/content/markdown/guides/mini/guide-encryption.md b/content/markdown/guides/mini/guide-encryption.md
index ccd67c40..c99a9699 100644
--- a/content/markdown/guides/mini/guide-encryption.md
+++ b/content/markdown/guides/mini/guide-encryption.md
@@ -41,6 +41,8 @@ The implemented solution adds the following capabilities:
 - server entries in the `settings.xml` have passwords and/or keystore passphrases encrypted
   - for now - this is done via CLI **after** master password has been created and stored in appropriate location
 
+**Important:** The password encryption provided by Maven 3.x is *obfuscation-grade* (it relies on a single-hash key derivation and provides no authenticated encryption). It is useful to keep secrets out of logs and screenshots, but it will not resist a determined attacker with access to the encrypted values. It is not a substitute for proper secrets management: keep restrictive file permissions on your `settings.xml` (e.g. `chmod 600`), prefer a secrets vault or your CI/CD secret store,  [...]
+
 ## How to create a master password
 
 Use the following command line: