Make CLI configuration token secure
- Dominant language
- Go
- Stars
- 1.4k
- Forks
- 363
- Avg merge
- 6d 13h
- Merged PRs (30d)
- 2
Description
## Description
Configuring the CLI requires users to specify the token with the `--token` flag.
This causes the token to stick around in the command line history, which can be easily viewed by someone.
(e.g. just `$ history | grep "exercism configure --token"` can bring my token right in front of the attacker)
## Solution
It would be safer if the equivalent of Python's getpass library is implemented to obtain input (or just plain STDIN). That way, the token is taken as input from a prompt and is not stored in the commands history.
## Additional Notes
Not that it's a huge security risk for users with personal computers, but it would be helpful for shared machines.
Contributor guide
Assessment
This issue has not been assessed yet.