Security
Short-lived or hashed credentials, minimal scopes, TLS everywhere.
- API keys shown once; stored as SHA-256 hashes; timing-safe compare.
- CLI pairing uses browser approval with PKCE and revocable per-machine tokens.
- Passwords hashed with scrypt.
- Device push tokens encrypted at rest.
- Report issues via contact or security.txt.