3 people 899a840439 docs: scope the plaintext-credentials claim to the server (BEA-120) (#176) ...

"No plaintext credentials ever touch disk" sat in the paragraph about the
server's auth.json, where it is true, and read on its own as a product-wide
promise the client does not keep: the device token lives in plaintext at
~/.bdrive/settings.json.

Say what the server does, then say what the client does — path, 0600 mode, and
that `bdrive logout` revokes it — in the same passage. Both halves check out
against the code (config.go's 0600 for everything under $BDRIVE_HOME,
DELETE /api/auth/token on logout).

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-19 13:21:44 -07:00

..

docs

docs: scope the plaintext-credentials claim to the server (BEA-120) (#176)

2026-08-19 13:21:44 -07:00