title: Vagrant insecure by default?
body: <p><strong>EDIT 2</strong>: TL;DR: <strong>the answer was yes in 2013, but this flaw has been fixed</strong></p>
  
  <p>By following the Getting Started instructions on vagrantup.com, I seem to end up with a virtual machine that is accepting SSH connections on port 2222 so that anyone can get root access to my VM and read my host working directory using the default credentials (username=password=vagrant or vagrant_insecure_private_key).</p>
  
  <p>Is this true? If yes, why is it not considered a gaping security vulnerability? What if I had copied sensitive data to the VM?</p>
  
  <p><strong>EDIT</strong>: and for those who think anyone on the internet being able to read your sources and executing arbitrary code on your VM is not that bad, I recommend reading the "Breaking out" section in this blog post <a href="http://blog.ontoillogical.com/blog/2012/10/31/breaking-in-and-out-of-vagrant/" rel="noreferrer">http://blog.ontoillogical.com/blog/2012/10/31/breaking-in-and-out-of-vagrant/</a></p>
  
  <p>In a nutshell: running Vagrant "as intended" can also enable anyone to break into your host/development machine (e.g., by using a malicious git post-commit hook).</p>