- Saved credentials are keyed by profile id. A sync peer (or a crafted
import using 'overwrite') could keep an existing profile's id but point
it at another host, user, GitHub API URL, RD Gateway or jump host, and
the saved password/token went there on the next connect without a
prompt. Such a change now forgets that profile's saved credentials
(audited), so the user is asked again.
- --answer / NEXUS_ANSWERS auto-fill every credential prompt and --answer
is visible in the process list; they're now refused unless --screenshot
is given (they exist for screenshot automation).
- Docs: IRC passwords are only sent over TLS/tunnel/loopback; sync's
retarget behaviour; the --answer restriction.
Andy Dixon
c8ab4d6557