GitHub CLI Authentication

GitHub CLI host configuration can identify authenticated GitHub hosts and may contain plaintext OAuth tokens when secure credential storage is unavailable.

Metadata

id: source-control.github-cli-auth
category: source-control
sensitivity: critical
subcategory: github-cli
artifact types: credential, token, configuration
tags: github, source-control

Path Matchers

Path	Kind	Platforms
`%APPDATA%\GitHub CLI\hosts.yml`	`file`	`windows`
`$HOME/.config/gh/hosts.yml`	`file`	`linux`, `macos`

Content Indicators

Literal strings:

oauth_token
git_protocol

Credential Types

oauth-token

Impact

credential_access
source_code_access

References