Your export contains passwords in readable form

What the audit found

The export file you submitted contains secrets in readable form: WiFi pre-shared keys, IPsec or L2TP secrets, PPP passwords, SNMP strings or similar. This happens when the export was created with the show-sensitive option on RouterOS 7, or with a plain export on RouterOS 6, which included secrets by default.

The audit reports this as informational. It is not a fault in your router configuration; it is a note about the file. Including secrets is in fact what allowed the audit to check password strength — the trade-off is that the file is now sensitive and should be treated accordingly.

Why it matters

This is a handling issue, not a security hole in the router, so keep the scale in mind: nothing about your device changed. What changed is that a text file now exists which, in the wrong hands, would let someone join your WiFi, connect to your VPN, or log in to your PPP or hotspot services.

Text files travel further than people expect. An export attached to an e-mail is stored on two mail servers and every device that syncs the mailbox. One pasted into a chat sits on the provider's servers indefinitely, searchable. One dropped into a shared folder is backed up and versioned. Forum posts asking for configuration help are a well-known source of leaked WiFi keys and VPN secrets, because the person posting did not notice they were in there.

The risk is entirely about where the copy goes and how long it survives. For an export you have just used for an audit, the answer is simple: delete it, or store it encrypted, and never send it through a channel you do not control.

The other lesson is to make future exports without secrets unless you specifically need them. A plain export on RouterOS 7 replaces every secret with a placeholder, and the result is safe to share for troubleshooting.

What it looks like in Winbox

This finding is about the file rather than a router setting, so there is no menu to check. You can see the difference by opening a terminal (New Terminal in Winbox) and comparing a plain export with one made using show-sensitive on RouterOS 7: in the first, values such as wpa2-pre-shared-key and ipsec-secret are shown as *****; in the second they are spelled out.

On RouterOS 6, an export shows secrets unless you add hide-sensitive.

How to fix it

Handle the file you have already created. Delete the export from wherever it went — your downloads folder, the router's Files list, any mail or chat you sent it through — and empty the deleted items. If you need to keep a copy, store it encrypted: a password-protected archive, an encrypted volume, or your password manager. If you suspect the file has been seen by someone who should not have it, change the secrets it contains and treat it as a normal rotation.

Then adjust how you create exports in future. On RouterOS 7 a plain export hides secrets by default, and the show-sensitive option is what reveals them, so simply leave it off; on RouterOS 6 the logic is reversed and you add the hide-sensitive option to get the safe form. Use the hidden form for anything you share or archive routinely, and the full form only with a specific reason — a disaster-recovery backup, or an audit that checks password strength — and a safe place to keep it. Nothing changes on the router itself, so Safe Mode does not come into it.

Afterwards, open the new export in a text editor and search for pre-shared-key, secret, password and community: the values should appear as ***** or be absent. Confirm the sensitive copy is gone from the places it was stored, then re-run the audit with the safe export and the finding disappears — along with the password checks, which need the secrets to run.

This finding has no remediation on the router itself; the full MKRouterKit report tells you which of the secrets it saw are weak and where each one is used.

FAQ

Should I just always export without secrets?

For sharing and routine archiving, yes. Keep one full export (or a binary backup) in an encrypted location as your disaster-recovery copy, because an export without secrets cannot restore WiFi and VPN access on its own.

The audit only checked my passwords because they were in the file. Was that a bad idea?

No — it is the intended trade-off. Password findings are among the most useful ones. The point of this note is what happens after the audit: delete the file or lock it away, rather than leaving it in a downloads folder or a chat thread.

Are user passwords for the router itself in the export?

No. RouterOS never includes router user passwords in an export, even with show-sensitive. They are only present in binary backups, which is one reason those should be stored with the same care.