security: --token CLI flag exposes token in process list and shell history

[samsonajulor]

Summary

The quikdb-frame login --token <value> flag passes the token as a CLI argument. This exposes the token in:

• ps aux output (visible to all users on shared systems)
• Shell history (~/.bash_history, ~/.zsh_history)
• CI/CD build logs if the command is logged

Vulnerable code

cmd/quikdb-frame/main.go

for i, arg := range os.Args {
    if arg == "--token" && i+1 < len(os.Args) {
        token = os.Args[i+1]  // visible in ps aux
    }
}

Fix

Read the token from an environment variable or file instead of a CLI flag:

// Option 1: env var (safest for CI/CD)
token := os.Getenv("QUIKDB_TOKEN")

// Option 2: file flag
// --token-file /path/to/token.txt

If keeping the --token flag, add a warning:

Warning: Passing tokens via CLI flags is insecure on shared systems.
Use QUIKDB_TOKEN environment variable in CI/CD instead.

Severity

MEDIUM — token exposure on shared systems or in logs.