Old ~/.config/credentials deleted on the operator's go (R-1134 closed); R-1130 accepted; R-1138 for its two backup copies (176 rows)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
2026-10-17 14:40:49 +02:00
parent e281de37c0
commit d4ce52e1bb
13 changed files with 108 additions and 11 deletions
@@ -15,7 +15,7 @@ There is deliberately NO "post for real" sub-command: real posting belongs to th
 from this spike's findings (audits/SPIKE-facebook-page-api-2026-10-08.md).

 SECRETS. The token comes from the CC secret store — run `sec run FACEBOOK_API -- python3 fb_probe.py …` — or,
-until the old file retires, from ~/.config/credentials (key FACEBOOK_API); no flag takes one.
+from a file given with --credentials (the old ~/.config/credentials was deleted 2026-10-17); no flag takes the token.
 It travels as `Authorization: Bearer`, never in a logged URL (the one query-string carrier,
 debug_token's input_token, is never printed: -v prints the path without its query). Every saved
 response passes redact(): every `access_token` key is dropped and any string carrying a held token