Easy default user and password is not secure

[alexbudarov]

Having admin/admin by default is not secure. These values are easy to guess.

If deploying person forgets to change password (or he/she is not informed about this add-on attached to the system at all) - then we have an open administrative access window to the system to any who knows system URL and has access to web client.

[alexbudarov]

It's like if Postgres had root/root superuser account accessible from local network, right after installation.

[dtsaryov]

@alexbudarov all CUBA apps have these creds for admin role - are they also not secure? :)

[alexbudarov]

Admin/admin for CUBA app is visible very well, it's on the foreground.

But people may:
a) do not know at all that cuba-jm was added to the application - if developers and operational team are separate
b) forget about cuba-jm because it is hidden inside
c) neglect it, not knowing that it provides administrative access