{"action":"created","issue":{"url":"https://api.github.com/repos/Particular/NServiceBus.AzureServiceBus/issues/16","labels_url":"https://api.github.com/repos/Particular/NServiceBus.AzureServiceBus/issues/16/labels{/name}","comments_url":"https://api.github.com/repos/Particular/NServiceBus.AzureServiceBus/issues/16/comments","events_url":"https://api.github.com/repos/Particular/NServiceBus.AzureServiceBus/issues/16/events","html_url":"https://github.com/Particular/NServiceBus.AzureServiceBus/issues/16","id":55613380,"number":16,"title":"ReplyTo Includes Shared Secrets and Keys","user":{"login":"particularbot","id":6763890,"avatar_url":"https://avatars.githubusercontent.com/u/6763890?v=3","gravatar_id":"","url":"https://api.github.com/users/particularbot","html_url":"https://github.com/particularbot","followers_url":"https://api.github.com/users/particularbot/followers","following_url":"https://api.github.com/users/particularbot/following{/other_user}","gists_url":"https://api.github.com/users/particularbot/gists{/gist_id}","starred_url":"https://api.github.com/users/particularbot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/particularbot/subscriptions","organizations_url":"https://api.github.com/users/particularbot/orgs","repos_url":"https://api.github.com/users/particularbot/repos","events_url":"https://api.github.com/users/particularbot/events{/privacy}","received_events_url":"https://api.github.com/users/particularbot/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-01-27T12:46:30Z","updated_at":"2015-01-27T12:46:30Z","closed_at":null,"body":"<a href=\"https://github.com/abombss\"><img src=\"https://avatars.githubusercontent.com/u/9210?v=3\" align=\"left\" width=\"96\" height=\"96\" hspace=\"10\"></img></a> **Issue by [abombss](https://github.com/abombss)**\r\n_2/17/2014 10:01:58 PM +00:00_\r\n\r\n_Originally opened as https://github.com/Particular/NServiceBus.Azure/issues/117_\r\n\r\n----\r\n\r\nThe replyTo property is putting in the whole connection string to the Azure Service Bus endpoint including any shared keys and secrets.  These properties are sitting on the message unencrypted and in plain view.  This should be corrected,"},"comment":{"url":"https://api.github.com/repos/Particular/NServiceBus.AzureServiceBus/issues/comments/71642362","html_url":"https://github.com/Particular/NServiceBus.AzureServiceBus/issues/16#issuecomment-71642362","issue_url":"https://api.github.com/repos/Particular/NServiceBus.AzureServiceBus/issues/16","id":71642362,"user":{"login":"particularbot","id":6763890,"avatar_url":"https://avatars.githubusercontent.com/u/6763890?v=3","gravatar_id":"","url":"https://api.github.com/users/particularbot","html_url":"https://github.com/particularbot","followers_url":"https://api.github.com/users/particularbot/followers","following_url":"https://api.github.com/users/particularbot/following{/other_user}","gists_url":"https://api.github.com/users/particularbot/gists{/gist_id}","starred_url":"https://api.github.com/users/particularbot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/particularbot/subscriptions","organizations_url":"https://api.github.com/users/particularbot/orgs","repos_url":"https://api.github.com/users/particularbot/repos","events_url":"https://api.github.com/users/particularbot/events{/privacy}","received_events_url":"https://api.github.com/users/particularbot/received_events","type":"User","site_admin":false},"created_at":"2015-01-27T12:46:30Z","updated_at":"2015-01-27T12:46:30Z","body":"<a href=\"https://github.com/abombss\"><img src=\"https://avatars.githubusercontent.com/u/9210?v=3\" align=\"left\" width=\"96\" height=\"96\" hspace=\"10\"></img></a> **Comment by [abombss](https://github.com/abombss)**\r\n<br />\r\n_https://github.com/Particular/NServiceBus.Azure/issues/117#issuecomment-35358882_\r\n\r\n----\r\n\r\nThose are two distinct concerns.  For the endpoint to reply it just needs the address sb://namespace/path/to/entity.  For actually connecting to the ReplyTo endpoint that should be an entirely separate concern. This seems very hackish and insecure.\r\n\r\nOur bigger issue is that we can't disable this and we won't pass a security audit.  All sensitive data needs to be encrypted in flight and at rest for us in the cloud.  The Properties on a message are sitting at rest in a queue in plain text."}}