svn commit: r1937659 - maven/website/content/guides/mini

[sv...@apache.org]

Author: svn-site-role
Date: Sun Aug 30 13:20:12 2026
New Revision: 1937659

Log:
2c828fb Document the obfuscation-grade nature of Maven 3.x password encryption (gh-12811)

Modified:
   maven/website/content/guides/mini/guide-encryption.html

Modified: maven/website/content/guides/mini/guide-encryption.html
==============================================================================
--- maven/website/content/guides/mini/guide-encryption.html	Sun Aug 30 13:06:55 2026	(r1937658)
+++ maven/website/content/guides/mini/guide-encryption.html	Sun Aug 30 13:20:12 2026	(r1937659)
@@ -219,7 +219,8 @@
 
 <li>for now - this is done via CLI <strong>after</strong> master password has been created and stored in appropriate location</li>
 </ul></li>
-</ul></section><section><a id="How_to_create_a_master_password"></a>
+</ul>
+<p><strong>Important:</strong> The password encryption provided by Maven 3.x is <em>obfuscation-grade</em> (it relies on a single-hash key derivation and provides no authenticated encryption). It is useful to keep secrets out of logs and screenshots, but it will not resist a determined attacker with access to the encrypted values. It is not a substitute for proper secrets management: keep restrictive file permissions on your <code>settings.xml</code> (e.g. <code>chmod 600</code>), prefer a secrets vault or your CI/CD secret store, or move to <a href="./guide-encryption-4.html">Maven 4</a> for stronger protection.</p></section><section><a id="How_to_create_a_master_password"></a>
 <h2>How to create a master password</h2>
 <p>Use the following command line:</p>