Description:
When you Set up an Ark wallet on BTCPayServer, your nsec is
- stored in clear text in the backend database
- is not removed, even when you Remove the Ark wallet via the UI
Version: Plugin 1.0.17.0
Steps to reproduce:
- Install plugin and Set up Arkade > enter nsec
- Connect to postgres.
SELECT * FROM "BTCPayServer.Plugins.Ark"."Wallets" returns plain text nsec
- In BTcPay, go to Arkade > Clear Wallet > Confirm
- Back to postgres.
SELECT * FROM "BTCPayServer.Plugins.Ark"."Wallets" still returns plain text nsec - even though it should have been purged.
Expected behaviour
- nsec should be stored salted/hashed, not in plain text. Server operator who hosts Stores for other users ("Uncle Jim") could steal their funds
- Clearing the Arkade wallet from the UI should remove the database record