gw manages SSH keys and delegates to GitHub CLI's stored authentication
tokens. If you find a security issue — anything that could leak, misuse, or
mismanage a credential — please report it privately rather than opening a
public issue.
Email askmaurya48@gmail.com with:
- A description of the issue and its potential impact
- Steps to reproduce, if possible
- Any relevant version/environment details
Please do not open a public GitHub issue for security reports until the issue has been addressed.
gw never stores secrets itself — SSH keys are referenced by path only,
and GitHub tokens are fetched from gh's own storage on demand, never
persisted by gw. Reports about gw reading, storing, or transmitting a
credential in a way that isn't documented in the README's "Known
limitations" section are especially welcome.