docs: identity traits are visible to user (#1621)

Co-authored-by: hackerman <3372410+aeneasr@users.noreply.github.com>
ory · Aug 4, 2021 · 641eba6 · 641eba6
1 parent 3eb87bc
commit 641eba6
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 0 deletions.
diff --git a/docs/docs/concepts/identity-data-model.mdx b/docs/docs/concepts/identity-data-model.mdx
@@ -172,6 +172,16 @@ switch (session.Identity.SchemaID) {
 }
 ```
 
+:::warning
+
+Please keep in mind that the Identity Model is not a place to store sensitive
+information that should not be visible to the end-user! Users can see traits and
+other data - except credentials - using the `sessions/whoami` endpoint. The
+Identity Model is not the right place to store data that should be obfuscated
+from the user!
+
+:::
+
 ## JSON Schema Vocabulary Extensions
 
 Because Ory Kratos does not know that a particular field has a system-relevant

diff --git a/docs/versioned_docs/version-v0.7/concepts/identity-data-model.mdx b/docs/versioned_docs/version-v0.7/concepts/identity-data-model.mdx
@@ -172,6 +172,16 @@ switch (session.Identity.SchemaID) {
 }
 ```
 
+:::warning
+
+Please keep in mind that the Identity Model is not a place to store sensitive
+information that should not be visible to the end-user! Users can see traits and
+other data - except credentials - using the `/sessions/whoami` endpoint. The
+Identity Model is not the right place to store data that should be obfuscated
+from the user!
+
+:::
+
 ## JSON Schema Vocabulary Extensions
 
 Because Ory Kratos does not know that a particular field has a system-relevant