Make sure the gh cli isn’t storing oauth credentials in plaintext as it can silently do.