In github.py, clone_repo() embeds the GitHub token directly in the git clone URL: https://x-access-token:{_token}@github.com/.... This exposes the token in process listings (ps aux), shell history, and any logs that capture subprocess arguments.
Suggested fix: Use git credential helpers or pass credentials via GIT_ASKPASS environment variable instead of embedding them in the URL. For example, set the token via the subprocess env parameter using GIT_ASKPASS pointing to a helper script, or use git -c credential.helper='!f() { echo password=$TOKEN; }; f' clone https://github.com/....
Identified by minbot code review
In github.py, clone_repo() embeds the GitHub token directly in the git clone URL:
https://x-access-token:{_token}@github.com/.... This exposes the token in process listings (ps aux), shell history, and any logs that capture subprocess arguments.Suggested fix: Use git credential helpers or pass credentials via GIT_ASKPASS environment variable instead of embedding them in the URL. For example, set the token via the subprocess
envparameter using GIT_ASKPASS pointing to a helper script, or usegit -c credential.helper='!f() { echo password=$TOKEN; }; f' clone https://github.com/....Identified by minbot code review