# \[KShare\] Avoid leaking sensitive information from Global Variables (Execution Profiles) **URL:** \ **Category:** Kshare\ **Tags:** linh-nguyen, thong-tran, variables, gatedknowledge, support, start-page, katalon-studio\ **Created:** [November 21, 2023, 8:00am UTC](https://forum.katalon.com/t/kshare-avoid-leaking-sensitive-information-from-global-variables-execution-profiles/104535 "2023-11-21T08:00:32Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![support.squad](https://dub1.discourse-cdn.com/katalon/user_avatar/forum.katalon.com/support.squad/32/23139_2.png) [@support.squad](https://forum.katalon.com/u/support.squad)\ **Post date:** [November 21, 2023, 8:00am UTC](https://forum.katalon.com/t/kshare-avoid-leaking-sensitive-information-from-global-variables-execution-profiles/104535/1 "2023-11-21T08:00:32Z")
> 🚨 **This is a security risk** > > "Can I store my profile somewhere else and still be able to access my projects and test cases?\*\* This is the question that we at Katalon Product Support team received from one of our enterprise users, who cares a lot about security and expect to have a security solutions from Katalon for their use case. In the past, Katalon supported only a secured solution for users working with the Katalon Runtime Engine (KRE) by overriding the value of arguments in the execution command. ![1](https://europe1.discourse-cdn.com/katalon/original/3X/6/0/605c739b5442972aade1c4f2ef8c3c2de2762b0b.png) ![2](https://europe1.discourse-cdn.com/katalon/original/3X/e/f/efdd049849ae5d3070a49a68b21714ea6c2104a1.jpeg) ![3](https://europe1.discourse-cdn.com/katalon/original/3X/5/7/57dcab5496697efd3818bf02eb4e8f8d910e75c2.png) > **USERNAME\_VAR** =“John Doe” > **PASSWORD\_VAR** =“ThisIsNotAPassword” > ./katalonc -noSplash -runMode=console -projectPath=“/Users/linh.nguyen/git/katalon-premium-reavealed/Secured Profiles/Secure Profiles.prj” -retry=0 -testSuitePath=“Test Suites/KRE\_Override\_Arguments\_TS” -browserType=“Chrome” -executionProfile=“default” -apiKey=“2658c724-2d3e-4f92-9dbe-f2645610\*\*\*\*” -orgID=84\*\*\* --config -webui.autoUpdateDrivers=true -g\_username=“${ **USERNAME\_VAR** }” -g\_password=“${ **PASSWORD\_VAR** }” For **Katalon Studio** , we will be discussing the available solutions that you might be applying and clarify the risks of them. Afterwards, we will provide you with a thoughtful solution. ### 1. The Unsecured Approaches #### 1.1. The first unsecured approach: Set the raw text > ℹ This approach refers to this test case **[Unsecured Set Text](https://github.com/thongnmtran/katalon-premium-reavealed/blob/b44bcaaab32cc2c201cd3f1bcb90b9481574883b/Secured%20Profiles/Scripts/Unsecured%20Set%20Text/Script1697789392334.groovy#L29)** ![4](https://europe1.discourse-cdn.com/katalon/original/3X/7/5/75ba97caafd76969791b1da65263b3e6c3bc6858.jpeg) The downside with this approach is that the password could be exposed if you push it to an online repository such as GitHub. #### 1.2. The second unsecured approach: Set raw text in the Execution Profiles (Global Variables) > ℹ This approach refers to this test case: \*\*[Unsecured Set Text with Profile](https://github.com/thongnmtran/katalon-premium-reavealed/blob/b44bcaaab32cc2c201cd3f1bcb90b9481574883b/Secured%20Profiles/Scripts/Unsecured%20Set%20Text%20with%20Profile/Script1697790612259.groovy#L33) ![5](https://europe1.discourse-cdn.com/katalon/original/3X/0/4/04d0b0d0290d554006991a5d58b8be8f6e992e02.png) ![2](https://europe1.discourse-cdn.com/katalon/original/3X/e/f/efdd049849ae5d3070a49a68b21714ea6c2104a1.jpeg) The downside with this approach is that, once again, the password could be exposed if you push it to an online repository such as GitHub. #### 1.3. The third unsecured approach: Use the encrypted text with the keyword WebUI.setEncryptedText > ℹ This approach refers to this test case: \*\*[Unsecured Set Encrypted Text](https://github.com/thongnmtran/katalon-premium-reavealed/blob/b44bcaaab32cc2c201cd3f1bcb90b9481574883b/Secured%20Profiles/Scripts/Unsecured%20Set%20Encrypted%20Text/Script1697789383987.groovy#L30) ![7](https://europe1.discourse-cdn.com/katalon/original/3X/a/9/a902ebdd4f00a8e9367b33238b99332a1850118d.jpeg) The downside with this approach is that the password could still be decrypted easily. #### 1.4. The fourth unsecured approach: Set the Encrypted Text in the Execution Profiles (Global Variables) > ℹ This approach refers to this test case: **[Unsecured Set Encrypted Text with Profile](https://github.com/thongnmtran/katalon-premium-reavealed/blob/b44bcaaab32cc2c201cd3f1bcb90b9481574883b/Secured%20Profiles/Scripts/Unsecured%20Set%20Encrypted%20Text%20with%20Profile/Script1697790624873.groovy#L34)** ![8](https://europe1.discourse-cdn.com/katalon/original/3X/f/0/f04d98c7c0ad7348dd975c308701e719e0042ec1.png) ![9](https://europe1.discourse-cdn.com/katalon/original/3X/1/2/127fe243ed049262a9bbb95cd00541bf330b2cb1.jpeg) The downside with this approach is that, similar to the third approach, the password could still be decrypted easily. ### 2. Are there any better solutions that we can apply to this case? There are two custom keywords in advance for two different approaches, which may suit different needs. #### 2.1 The first secured approach - The "defineSecuredProfiles” keyword ![10](https://europe1.discourse-cdn.com/katalon/original/3X/5/1/51094ce1db12e58309e704eb113a9f786d43ef98.jpeg) **How it works?** 1. **Load variables** from the execution profile file to the execution environment. 2. **Remove** the **execution profile file** from the **Git Repo** (The file is still **available** in the **local machine** ) (\* ) 3. Add the execution profile to the Git Ignore file to prevent committing that file next time. (\*\*) > ℹ (\*) (\*\*): You should only follow these steps if your execution profile files are located in Katalon Projects’ “Profiles” folder. ![image (11)](https://europe1.discourse-cdn.com/katalon/original/3X/4/9/4969dedc580b00596271e140b889960125b48d8d.png) #### 2.2. The second secured approach - The “loadProfile” keyword When you want to **keep** the **execution profile files** in the **Git repository** , use this keyword. Also, this keyword is **flexible** to **support different path formats** , such as **relative path, absolute path, and with/without file extension.** ![Screen Shot 2023-10-25 at 11.58.26](https://europe1.discourse-cdn.com/katalon/original/3X/2/d/2d3c89a78d817a8e2ebb5ce2e0e7d2cbde36a3e4.png) > ℹ // **“./Profiles/secured\_production\_profile.glbl”** > > CustomKeywords.‘SecuredProfile.loadProfile’(' **secured\_production\_profile.glbl**') → If the selected profile exists in the Katalon Projects’ Profiles folder, the “Profiles” folder path can be omitted. > ℹ // "./ **Custom Folder** /secured\_production\_profile. **glbl**" > > CustomKeywords.‘SecuredProfile.loadProfile’(' **Custom Folder/secured\_production\_profile**') → The keyword is helpful automatically append the file extension to your file name. > ℹ // " **C:/Users/me/Desktop/secured\_production\_profile.glbl**" > > CustomKeywords.‘SecuredProfile.loadProfile’(‘C:/Users/me/Desktop/secured\_production\_profile’) An example for the absolute file path. Our sample project [here](https://github.com/thongnmtran/katalon-premium-reavealed). * * * The Product Support team is happy to listen to you with more ideas, feedback and suggestion that you may have after this article. ---
**Author:** ![albert.vu](https://dub1.discourse-cdn.com/katalon/user_avatar/forum.katalon.com/albert.vu/32/20595_2.png) [@albert.vu](https://forum.katalon.com/u/albert.vu)\ **Post date:** [November 21, 2023, 8:00am UTC](https://forum.katalon.com/t/kshare-avoid-leaking-sensitive-information-from-global-variables-execution-profiles/104535/2 "2023-11-21T08:00:32Z")
Thank you Product Support team (@support.squad) as always for this insightful topic. And also a big shout-out to the two individuals below for your contribution to this topic: | ![Linh Nguyen](https://europe1.discourse-cdn.com/katalon/original/3X/8/4/84e17374fb62b33f2d3ea89a16c9bf09f01aaf0b.png) | ![Thong Tran](https://europe1.discourse-cdn.com/katalon/original/3X/2/4/2473c611894c7134b42923bcd8045dfc1afcef73.png) | | --- | --- | | **Linh Nguyen** (@linh.nguyen) - Product Support Manager at Katalon | **Thong Tran** (@thong.tran) - Senior Software Engineer at Katalon | | Linh is the Product Support team Manager at Katalon. She spent many years working as an Automation Testing QA before joining Katalon Product Support as a technical support expert. Based on her experiences, she usually provides customers with highly applicable solutions. She now manages her team with a user-centric approach to guarantee customers greater success with Katalon Products. | A passionate Katalon developer with a wealth of programming and testing expertise. Thong has been dedicated to providing exceptional enterprise support for the past five years, helping Katalon’s customers achieve their testing goals with ease. | ---
**Author:** ![albert.vu](https://dub1.discourse-cdn.com/katalon/user_avatar/forum.katalon.com/albert.vu/32/20595_2.png) [@albert.vu](https://forum.katalon.com/u/albert.vu)\ **Post date:** [March 12, 2024, 3:10am UTC](https://forum.katalon.com/t/kshare-avoid-leaking-sensitive-information-from-global-variables-execution-profiles/104535/8 "2024-03-12T03:10:47Z")
Do you have an idea for a topic that you would like the Product Supoprt team to cover in their next [KShare](http://forum.katalon.com/docs?ascending=false&solved=false&tags=support) article? Then share them with us by simply fill in the form below 👇 > **[\[KShare\] Your feedback matters!](https://forms.gle/v8FVQ2GFMk4Dcuox9)** > > Have an idea for which topic we should cover in our KShare articles next? Then let us know in this form!