Heck, most CLI tools keep credentials in text files which are very easily read by random apps. Sometimes people will keep all a bunch of API keys in a single .b

Heck, most CLI tools keep credentials in text files which are very easily read by random apps. Sometimes people will keep all a bunch of API keys in a single .bashrc file, which gets passed down to every child. On macOS I've been experimenting with creating a separate keychain for storing most of my API keys. Once keys are stored securely, you can write a wrapper for each tool. The wrapper just has to read the value from the keychain and call the original. That way you lower the changes of keys being needlessly shared. It has good UX too, since it only has to prompt you when it's first used. Although for that to really work I think you have to sign the wrapper, otherwise anyone can just edit it.