Credential exposure risk in data-sources.json during project export

Direct answer

Enabling a master password does not automatically bulk re-encrypt all existing entries in credentials-config.json. Existing credentials remain encrypted with the previous key and are typically re-encrypted lazily when the connection is opened, or require an explicit re-save / change master password operation to migrate them.

For a safe project export, do not export raw workspace files. Export a DBeaver project with credentials excluded, then manually sanitize data-sources.json of connection metadata before sharing. Do not include credentials-config.json in any shared archive.

Confirmed facts

• DBeaver stores connection metadata in data-sources.json and encrypted credentials separately in credentials-config.json within the workspace directory.
• Save password is opt-in. data-sources.json does not contain clear-text passwords, but it does contain host, port, database name, schema and username.
• Without a master password DBeaver relies on an internal key and OS secure storage where available. Encryption strength and fallback behavior are version and OS sensitive.

Likely explanation

Master password activation is not a retroactive bulk migration. Likely behavior is lazy re-encryption on access, so previously saved credentials stay under the old encryption until each connection is opened and re-saved. On different operating systems the fallback to internal key encryption varies, so workspace files copied to another OS can become more easily decryptable if no master password is set.

Exporting the workspace project can leak hostnames, usernames and connection structure even when passwords are omitted. That metadata is sufficient for reconnaissance.

Steps needed for this case

1. Set a master password in DBeaver Preferences > Security. Verify it is active.
2. Open each previously saved connection once after enabling the master password and re-save the connection to force migration of its credential entry.
3. When exporting, use File > Export > DBeaver Project and ensure the option to include credentials is disabled. Do not export the raw workspace folder.
4. Inspect the exported archive before sharing:
   • Confirm credentials-config.json is absent.
   • Open data-sources.json and redact or replace host, port, database, schema and username fields with placeholders.
5. Treat the export as a template, not a live workspace. Recipients should recreate connections with their own credentials.

One diagnostic detail that changes the recommendation: which DBeaver edition and version you are using, and whether you rely on OS secure storage. Version differences affect master password migration behavior and export options.