Skip to content

Authentication token is shown when approving a remote task file #2329

@liiight

Description

@liiight

Description

When defining a remote taskfile using authentication the token is shown in the remote file approval message in plain text

❯ export TOKEN=REDACTED_TOKEN
❯ task
The task you are attempting to run depends on the remote Taskfile at "https://:REDACTED_TOKEN@REDACTED_URL.git//Taskfile.dist.yml?ref=master".
--- Make sure you trust the source of this Taskfile before continuing ---
Continue? [y/N]:

Version

3.43.3

Operating system

MacOS 15

Experiments Enabled

Remote Taskfiles

Example Taskfile

version: '3'
includes:
  remote: https://:{{.TOKEN}}@{{.REDACTED_URL}}.git/Taskfile.dist.yml?ref=master

Metadata

Metadata

Assignees

No one assigned

    Labels

    state: needs triageWaiting to be triaged by a maintainer.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions