obsidian-security-basics

name	obsidian-security-basics
description	Implement secure Obsidian plugin development practices. Covers credential storage, input validation, XSS prevention, network security, URI handler safety, and Electron security. Use when handling user data, storing API keys, making network requests, or preparing for community plugin submission. Trigger with phrases like "obsidian security", "secure obsidian plugin", "obsidian data protection", "obsidian privacy", "obsidian api key storage".
allowed-tools	Read, Write, Edit, Grep
version	1.13.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["obsidian","security","authentication","privacy","electron"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Obsidian Security Basics

Overview

Security practices for Obsidian plugin development. Plugins run with full vault filesystem access and can make arbitrary network requests inside Electron. Responsible development requires protecting credentials, sanitizing external data, validating URI handlers, minimizing permissions, and following Obsidian's plugin guidelines to avoid community submission rejection.

Prerequisites

• Obsidian plugin development environment
• Understanding that .obsidian/plugins/<id>/data.json is synced by cloud services
• Awareness of Obsidian Plugin Guidelines

Instructions

Step 1: Credential Storage — Never in data.json

Plugin settings (data.json) live inside the vault and are synced by iCloud, Dropbox, Obsidian Sync, and Git. API keys stored here are effectively public.

// BAD: API key stored in plugin settings (synced to cloud, committed to Git)
interface BadSettings {
  apiKey: string; // This ends up in .obsidian/plugins/my-plugin/data.json
}

// GOOD: Use Electron's safeStorage for desktop (encrypted at OS level)
import { Platform } from 'obsidian';

export class SecureStorage {
  private plugin: Plugin;

  constructor(plugin: Plugin) { this.plugin = plugin; }

  async storeSecret(key: string, value: string): Promise<void> {
     (.) {
      
       { safeStorage } = (). || ();
       (safeStorage.()) {
         encrypted = safeStorage.(value);
         data =  ..() ?? {};
        data[] = encrypted.();
         ..(data);
        ;
      }
    }
    
    
    ..(key, value);
  }

   (: ): < | > {
     (.) {
       { safeStorage } = (). || ();
       data =  ..();
       encrypted = data?.[];
       (encrypted && safeStorage.()) {
         safeStorage.(.(encrypted, ));
      }
    }
     ..(key) ?? ;
  }

   memoryStore =  <, >();
}


 () {
   (!.) {
    . =  .();
  }
}