fix: pass Supabase session tokens via env to avoid argv disclosure (CWE-200)#458

Open

sebastiondev wants to merge 2 commits into

wonderwhy-er:mainfrom

sebastiondev:fix/cwe200-blocking-offline-upd-device-5da3

Commits on May 1, 2026

fix: pass device tokens via env vars instead of command-line args (CWE-200)
sebastiondev
committed
address review: bail on missing refresh_token; harden argv regression test
sebastiondev
committed