Claude Code Stores OAuth Tokens in Plaintext
Summary
The article reveals Claude Code stores OAuth tokens in plaintext in a local credentials file, despite claims of secure storage, highlighting the limitations of relying on file permissions alone. It argues for a modular secret-store interface (SecretSpec) to securely persist credentials and outlines OS-specific storage behavior and open-source implications.