# Security

- Do not log OAuth access/refresh tokens, ChatGPT account IDs, device/session IDs,
  Sentinel tokens, or raw conversation payloads in CI logs.
- `CHATGPT_WEB_DEBUG=1` writes unredacted conversation payloads to the local cache dir;
  never enable it in CI or shared environments.
- Live scripts must redact secrets when printing errors.
- This plugin talks to an unofficial ChatGPT web backend; treat credentials as
  high-value and prefer OpenCode’s auth store over committing `auth.json`.
- Scan harness receipts and artifacts with `npm run harness:scan` before uploading or retaining
  them. `report.json`, `junit.xml`, and `report.md` must not contain access or refresh tokens,
  bearer credentials, JWTs, API keys, Sentinel tokens, raw auth files, account/device/session IDs,
  cookies, conversation IDs, or ChatGPT session material.