Repository navigation
QUICKSTART export block leaks the USAi key into shell history and isn't marked as the non-interactive path #340
Description
Part of #335
What's wrong
The QUICKSTART export block leaks the USAi key into shell history and is not marked as the non-interactive (scripting) path. It never points the reader at the interactive acq secret set flow. The README.md:53 / :61 "set ahead of time only when scripting" qualifier softened this but did not fix it.
Evidence (file:line)
- QUICKSTART.md:201 — export block is unqualified; never points at the interactive
acq secret setflow. - README.md:53, 61 — "set ahead of time only when scripting" qualifier (softened, not fixed).
Suggested fix
- Mark the export block explicitly as the scripting / pre-seed path.
- Cross-link the interactive
acq secret setflow. - Note the shell-history exposure risk.
Severity: minor.
Surfaced via an automated audit (Fable) against a public clone; validated against main 2026-08-19. AI-assisted (OpenCode).
Activity
wz-gsa commentedon Aug 20, 2026
Addressed in open PR #345 (awaiting review). Grooming 2026-08-20.
docs: fix first-day default-path accuracy (USAi, backend primacy, dea…
wz-gsa commentedon Aug 20, 2026
Fixed on main by merged PR #345 (QUICKSTART export → read -rs prompt + interactive cross-link; no longer leaks the key to shell history).