steid
Sign in

@jamesgill /

steid

docs: stop recommending a credential helper that stores plaintext

The README told people to use `credential.helper store`, which writes the token
in clear text to ~/.git-credentials. Steid hashes tokens server-side precisely
so a stolen database holds nothing presentable; telling the user to keep the
plaintext on their laptop hands back exactly what that protects.

Now recommends the OS keystore helper per platform, and warns against putting
the token in the remote URL, where it lands in .git/config, `git remote -v` and
shell history.

Also says the thing a newcomer actually wants to know, since it is the first
friction they hit: you type the token once and the helper answers every push
after that. Pushing to GitHub feels credential-free for that reason and no other.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JZwc7URWKVhkAuRTWiDmjA
JamesPatrickGill authored 7 days agoparentef23868Browse filesaa20db5755a2fb4586465bb0b9eb966ba39467cf

1 file changed+17 −2

README.md+17 −2View file
@@ -199,12 +199,27 @@ git push -u origin main
199199
200200 Git will ask for a username and password. The token goes in the **password** field; the
201201 username is ignored (a token pasted as the username with an empty password also works,
202−because people do that). Let your credential helper remember it:
202+because people do that).
203+
204+You only type it once. Git's credential helper stores it and answers every later push —
205+which is the whole reason pushing to GitHub feels like it needs no credentials. Use the
206+one that keeps secrets in your operating system's keystore:
203207
204208 ```sh
205−git config --global credential.helper store
209+git config --global credential.helper osxkeychain # macOS (usually already set)
210+git config --global credential.helper manager # Windows
211+git config --global credential.helper libsecret # Linux
206212 ```
207213
214+**Not `credential.helper store`.** It writes the token in clear text to
215+`~/.git-credentials`, and a token is a password that never expires. Steid keeps only a
216+hash of it precisely so that a stolen database contains nothing anyone can present;
217+storing the plaintext on your laptop hands back what that was protecting.
218+
219+**Do not put the token in the remote URL** (`https://user:token@host/...`) either. It
220+goes into `.git/config` in clear text and shows up in `git remote -v`, in shell history,
221+and in any log that records the URL.
222+
208223 Cloning a public repository needs no credentials at all.
209224
210225 ## Configuration