This tool accesses your ChatGPT web session and writes authentication tokens to the local filesystem. This is inherently sensitive — handle with care.

The following are permanently excluded via .gitignore and must never be pushed:

If any of these are compromised:

1. Sign out from all ChatGPT sessions
   • Go to https://chatgpt.com → Settings → Security → Sign out all devices
2. Delete the browser profile — rm -rf browser-profile/
3. Delete all backups — rm -rf backups/
4. Regenerate credentials — Change your ChatGPT password
5. Rotate any API keys that may have shared the same environment

The refresh script explicitly strips token values before writing to logs:

const safe = { ...row };
delete safe.token;          // <-- token never touches disk
fs.appendFileSync(logPath, JSON.stringify(safe) + '\n');

Only the following metadata is recorded:

• Timestamp and status (success/error)
• Whether accountId was present (boolean)
• Whether userEmail was present (boolean)
• Session expiry timestamps

No raw token strings, no JWT payloads, no passwords.

If you find a vulnerability in how this tool handles authentication data:

• Don't open a public issue
• Do email the repository owner directly, or open a draft security advisory on GitHub