Forum Discussion
integralist
6 months agoNew Contributor
Security concern with allowing Terminal complete access to my 1P account via op CLI
I have a shell script that uses 1Password secret reference:
export EXAMPLE_API_KEY=$(op read "op://Vault-Name/Example API Token/Specific-Token/Token")
But when it's loaded, I have to authorise the terminal/shell to have access to it (see screenshot)
My concern is that it's giving the terminal/shell access to my entire account and all vaults within it when I only want to provide it with access to one entry within a single vault.
What happens if I had a malicious script installed that scans for 1Password secret references across multiple files? The script might not be able to identify the "account" but it just needs the vault names. Then it can start to build up common names for identifying secrets stored within 1Password and try requesting them, and if I've already authorised the terminal/shell I won't see a popup notification and so the script would be free to access the secrets.
Initially, I moved any secrets I use for development work into a separate vault, which I thought would help when it came to the terminal/shell requiring access via a 1Password secret reference because it would only have access to that specific vault (reducing the blast radius) but that's when I noticed it wasn't getting access to just the vault but the entire account.
I'm not sure how much of an issue people think this is but it worries me.
1Password Version: 8.10.40
Extension Version: Not Provided
OS Version: macOS 15.1
Browser: Chrome