azctl is pre-1.0. Security fixes target the latest release and main.

Please do not open a public issue for security problems.

Instead, report privately through GitHub's security advisory form. Include:

• A description of the issue and its impact.
• Steps to reproduce, or a proof of concept.
• Any suggested remediation.

You can expect an initial acknowledgement within a few days. Once a fix is available, the advisory will be published with credit to the reporter (unless anonymity is requested).

azctl works with Azure DevOps Personal Access Tokens (PATs). A few notes relevant to security:

• PATs are never written to the config file. They are resolved from --pat-stdin, the ADO_PAT environment variable, or the OS keychain.
• The keychain entry written by azctl auth login is scoped to the target server host.
• With --debug, request logging redacts the Authorization header so PATs do not leak into logs.
• Grant PATs the minimum scopes required (typically Code read/write and Build read/execute).