>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3540688. --> Reported by: [mxr576](https://www.drupal.org/user/315522) >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>The recipe currently uses the Config key storage by default, which stores API credentials directly in the database. While this is a viable solution for proof-of-concepts and development environments, it poses security risks for production deployments where credentials should not be stored in the active configuration that gets exported and versioned.</p> <p>Production environments require more secure credential storage methods to prevent sensitive information from being inadvertently exposed through configuration exports, version control, or database backups.</p> <h4 id="summary-steps-reproduce">Steps to reproduce</h4> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <ol> <li>Add a prominent warning in the recipe documentation and/or post-install messaging that the default configuration storage is not suitable for production environments</li> <li>Provide clear guidance on how to change the key provider to a more secure option (such as Environment variable or File storage) after applying the recipe</li> <li>Consider adding recipe input options in future versions to allow users to specify the desired key storage method during installation</li> </ol> <p>Potential future enhancement: Add a recipe input parameter to switch between "config" and "env" storage providers, where the environment variable option would require setting an environment variable before or after the recipe is applied.</p> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <h3 id="summary-ui-changes">User interface changes</h3> <h3 id="summary-api-changes">API changes</h3> <h3 id="summary-data-model-changes">Data model changes</h3> > Related issue: [Issue #3559052](https://www.drupal.org/node/3559052) > Related issue: [Issue #3559854](https://www.drupal.org/node/3559854)