Security with templates/pbit files

[Anonymous]

I'd like to share some of our reports with others in my field, but I'm worried about the security of doing so. I can't figure out whether it's actually safe to share pbit files. Does anybody know? It doesn't look like they contain data, but do they keep passwords? Is there anything else I should worry about with sharing pbit files?

Thanks.

[Seward12533]

Are hard coding passwords or using windows authentication. If using an authentication method the user won’t be able to refresh the data but can see anything published to models as tables in the table view. And can export data to excel. For a secure sharing environment you need to use BI Service and row Level security.

[Anonymous]

Thanks Seward... Some of that sounds like normal power bi though. I guess I'm really just curious what is stored in a pbit file when you export it. This would be going to a totally different organization, so things like RLS aren't a possibility or really applicable. 

I know that credentials can be stored in a file or globally. But do those transfer to pbit files? If so, is there some obvious way to clear them from just the template? 

[Seward12533]

I'm pretty sure when you export to PBIT you only get the model with none of the security.  The one thing I'm not sure of is if exclicit database or other credentials where the ID and PW are fixed and typed in when you set up the query get stored.  Its easy enough to test tho. Save and PBIT and then open and see if YOU can refresh or access any data without specifying the credentials again.