You Can't Hide a Secret from a Process That Runs as You

I have a handful of CLI tools I built for myself: gmailctl searches and drafts emails. gdrivectl reads and edits Google Docs. transcriber processes podcast, interviews and announcements for KubeFM . They all stored their OAuth credentials (the tokens that let them act on my behalf with Google) in plaintext JSON files on disk, the same way the AWS CLI stores credentials in ~/.aws/credentials . This…