Skip to content

Add security warning for accounts with inline keys #2250

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chasefleming merged 3 commits into from
Jan 7, 2026
Merged

Add security warning for accounts with inline keys #2250

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5d1556d
Add warning for extract
chasefleming Jan 7, 2026
32a77ab
Colorize command and add url
chasefleming Jan 7, 2026
2f59f99
Add file
chasefleming Jan 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 33 additions & 2 deletions internal/command/command.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,20 +34,21 @@ import (
"sync"
"time"

"github.com/onflow/flow-cli/internal/prompt"

"github.com/coreos/go-semver/semver"
"github.com/dukex/mixpanel"
"github.com/getsentry/sentry-go"
"github.com/spf13/afero"
"github.com/spf13/cobra"

"github.com/onflow/flowkit/v2"
"github.com/onflow/flowkit/v2/accounts"
"github.com/onflow/flowkit/v2/config"
"github.com/onflow/flowkit/v2/gateway"
"github.com/onflow/flowkit/v2/output"

"github.com/onflow/flow-cli/build"
"github.com/onflow/flow-cli/common/branding"
"github.com/onflow/flow-cli/internal/prompt"
"github.com/onflow/flow-cli/internal/settings"
"github.com/onflow/flow-cli/internal/util"
)
Expand Down Expand Up @@ -131,6 +132,9 @@ func (c Command) AddToParent(parent *cobra.Command) {
checkVersion(logger)
}

// warn about inline keys in config
checkForInlineKeys(state, logger)

// record command usage
wg := sync.WaitGroup{}
go UsageMetrics(c.Cmd, &wg)
Expand Down Expand Up @@ -328,6 +332,33 @@ func isDevelopment() bool {
return build.Semver() == "undefined"
}

// checkForInlineKeys warns users if they have accounts with inline private keys in flow.json
func checkForInlineKeys(state *flowkit.State, logger output.Logger) {
if state == nil {
return
}

var inlineKeyAccounts []string
for _, account := range *state.Accounts() {
if _, isHexKey := account.Key.(*accounts.HexKey); isHexKey {
inlineKeyAccounts = append(inlineKeyAccounts, account.Name)
}
}

if len(inlineKeyAccounts) > 0 {
cmd := branding.GreenStyle.Render("flow config extract-key --all")
logger.Info(fmt.Sprintf(
"\n%s Security warning: %d account(s) have private keys stored directly in flow.json: %s\n"+
" Extract them to separate key files by running: %s\n"+
" Learn more: https://developers.flow.com/build/tools/flow-cli/flow.json/security\n",
output.WarningEmoji(),
len(inlineKeyAccounts),
strings.Join(inlineKeyAccounts, ", "),
cmd,
))
}
}

// initCrashReporting set-ups sentry as crash reporting tool, it also sets listener for panics
// and asks before sending the error for a permission to do so from the user.
func initCrashReporting() {
Expand Down
Loading