Security report sent via email - please check

[d4ruvil]

Hi, I sent a security report to your email on Aug 25 but haven't heard back. Wanted to flag it here in case it got
missed - no need to discuss details publicly, just let me know a good way to reach you. Thanks for building Ackee!

[flipvh]

@electerious this is a valid issue or not? 😅

[electerious]

@d4ruvil Thanks for the report!

You’re right that permanent tokens currently have the same permissions as regular login tokens. That’s how the API is designed right now, rather than an unintended issue in the authentication flow. Not perfect and something that should be improved. When you have a permanent token, you have access to the instance, so they should be kept as private as username/password.