From eec7b0098fa0d35bfc48e3b4cf6f902efde8620e Mon Sep 17 00:00:00 2001
From: Jeff Ohrstrom <johrstrom@osc.edu>
Date: Wed, 13 Sep 2023 12:46:54 -0400
Subject: [PATCH] add a warning about usernames & passwords

---
 source/customizations/support-ticket.inc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/source/customizations/support-ticket.inc b/source/customizations/support-ticket.inc
index 1cc862af..4f496bee 100644
--- a/source/customizations/support-ticket.inc
+++ b/source/customizations/support-ticket.inc
@@ -44,6 +44,12 @@ These are the most common configuration properties needed to enable and setup th
 * ``delivery_settings``: Rails settings object to set the transport configuration properties.
   See example below or the `Rails documentation on mailers <https://guides.rubyonrails.org/action_mailer_basics.html#action-mailer-configuration>`_.
 
+.. warning::
+
+  Use caution when supplying username and password in delivery_settings.  These files are readable by
+  unprivileged users and as such this information can be found by a sophsticated user without privilege
+  escelation.
+
 Sample configuration:
 
   .. code-block:: yaml