r-zakarya
c73ac66313
Kept in settings.bin, because the silent refresh needs it and so does the first download on a fresh device - there is no vault to hide it in yet. But it was the only secret on that screen shown in clear, right beside a masked password field, and it is also the least protected of the three: settings.bin is sealed by the no-auth Keystore key, readable without authentication, unlike the vault. Masked now. It is typed once, and reading it back has no use - a wrong token shows up as a 401 in the log, not by squinting at the field. What it opens stays worth knowing: read access to the account's repositories, whose only content is ciphertext. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
