Security Review

Security Review

Review Scope

Security review refreshed for release 0.2.7.

Reviewed areas:

• tracked repository files
• git history
• CLI auth and session handling
• installer behavior
• native app logging behavior
• local persistence paths

Findings

• no hardcoded GitHub tokens were found in tracked files
• no API keys or private key material were found in tracked files
• no matching secret/key patterns were found in git history
• no code path was found that intentionally stores GitHub auth secrets to disk

Data Handling

The product stores only convenience session data:

• GitHub host
• GitHub account name
• repository target

Current path:

~/Library/Application Support/GH Workflow Clean/last-session.env

Legacy compatibility path:

~/Library/Application Support/GitHub Action Clean-Up Tool/last-session.env

Hardening And UI Safety State In 0.2.7

• the native app redacts common token and key patterns from the live log panel before display
• repo, wiki, and release docs were updated to reflect the review outcome
• the native app now bundles help files, production metadata, and brand references
• security notes were documented for users and maintainers
• GitHub auth controls were moved off the main cleanup dashboard into a dedicated Settings page
• fast auth actions remain available in the lower status bar without exposing tokens

Residual Risk

• the product depends on the user’s existing gh authentication state
• non-secret account and host information can still appear in normal CLI output
• destructive cleanup remains the main product risk, not secret persistence

Related Pages

• Project Info
• Safety and License
• Terms of Service