Security Patterns for CLI Tools That Handle Credentials

Security Patterns for CLI Tools That Handle Credentials CLI tools that interact with APIs, databases, or cloud services inevitably handle secrets. API keys, tokens, passwords, connection strings — all flowing through your tool. One careless decision and those secrets end up in shell history, log files, environment variable dumps, or npm packages. This article covers the security patterns every CLI tool author needs to know — from credential storage to safe logging to supply chain protection. 1. Never Accept Secrets as Command-Line Arguments # DANGEROUS: visible in shell history, ps output, process lists mytool deploy --api-key sk_live_abc123 Command-line arguments are visible to every user on the system via ps aux . They're stored in shell history files. They appear in CI logs. Instead, accept secrets through: // Priority order for secret resolution function getApiKey ( options : CliOptions ): string { // 1. Environment variable (best for CI) if ( process . env . MYTOOL_API_KEY ) { ret