---
created: 2026-07-30T22:19:31.770Z
title: Fedimint gateway must not install with a pre-set password
area: security
severity: blocker
files:
  - core/archipelago/src (app orchestrator / secrets materialisation)
---

## Problem

Dorian reports (2026-07-30): the Fedimint gateway app installs with a password already set up — i.e. a default/pre-baked credential rather than one generated at install time or set by the user. Default credentials on a Lightning/fedimint gateway are a security hole: anyone knowing the shipped default can access the gateway. Dorian rated this a blocker.

This also violates the repo's standing secrets invariant (CLAUDE.md): secrets must be manifest-declared (`generated_secrets`, materialised by `container::secrets`, 0600/rootless) — never hardcoded or per-app baked in.

## Solution

Tracked as requirement **FED-07** (Phase 1, ROADMAP success criterion 7 — needs a gap plan since phase 1's 10 plans predate it):
- Find where the fedimint gateway app's manifest/install path sets its password (check `/opt/archipelago/apps/*/manifest.yml` for the gateway, and the orchestrator's secrets materialisation).
- Move it to `generated_secrets` so each install gets a unique credential, or require explicit user setup.
- Migration path for existing installs still carrying the default password (migrations must never destroy data).