This CLI tool handles sensitive information (GitHub tokens and repository access). We take security seriously.

Personal Access Tokens are stored securely in your system's configuration directory:

• macOS:~/Library/Preferences/github-extractor-nodejs/
• Linux:~/.config/github-extractor-nodejs/
• Windows:%APPDATA%\github-extractor-nodejs\

These directories are never included in the repository and are automatically excluded by .gitignore.

The following sensitive items are excluded from version control:

# Downloaded repositories (may contain proprietary code)
repositories/
*.zip
*.tar.gz
# Configuration and credentials
config.json
.env
.config/
# Auth tokens
*.pem
*.key

1. Never share your Personal Access Token
2. Use tokens with minimal required scopes (repo and read:org only)
3. Set token expiration based on your security policy
4. Revoke tokens when no longer needed: https://github.com/settings/tokens
5. For SAML orgs: Always authorize tokens for SSO before use

1. Never commit tokens or credentials to the repository
2. Use .env files for local testing (already in .gitignore)
3. Run security checks before commits:

   # Check for secrets
   git diff --cached | grep -i "token\|secret\|password\|key"

4. Don't include actual organization names or repository data in tests

If you discover a security vulnerability, please:

1. DO NOT open a public issue
2. Email the maintainers directly (add contact email)
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

We will respond within 48 hours and work with you to address the issue.

This project follows these security practices:

• ✅ No credentials in source code
• ✅ Input validation for all user inputs
• ✅ Secure token storage using conf library
• ✅ HTTPS by default for API calls
• ✅ Comprehensive .gitignore
• ✅ Regular dependency updates
• ✅ Type safety with TypeScript

We regularly update dependencies to patch security vulnerabilities. To check for vulnerabilities:

npm audit
npm audit fix

See LICENSE for details.