Austin Horstman 0467f24e31 aerc: warn that the OAuth2 client secret is world-readable ...

When the matching imapAuth or smtpAuth is oauthbearer or xoauth2, a
non-null client_secret is URL-encoded into the source or outgoing URL
in accounts.conf, which is a world-readable Nix store file. Say so in
the option description.

The access or refresh token does not need to be in that file. The
module sets source-cred-cmd and outgoing-cred-cmd from passwordCommand,
and aerc uses the command's output as the access token, or as the
refresh token when token_endpoint is set. Say that too.

2026-09-25 13:01:17 -05:00

..

accounts.nix

aerc: warn that the OAuth2 client secret is world-readable

2026-09-25 13:01:17 -05:00

default.nix

aerc: document configuration paths and permissions

2026-09-22 20:40:46 -05:00