Docs - assurances regarding OCN credentials #49
Description
In the docs, the phrase
Don't worry, the username and password are hashed and are not accessible to the developers or other users
appears.
While obviously it is the genuine intention of the devs that this statement be accurate, you shouldn't be giving users such broad assurances. The reality is that a malicious party with access to a server running an instance of SunshineAPI would be trivially able to harvest user credentials.
I suggest adding some sort of strong cautionary note to this effect, and perhaps offering a clearly-documented alternative way for people to obtain their own session cookie if they don't want to trust a third party with their credentials.