iamtoruk 0dff0b66d5 docs(menubar): state what the Keychain move actually guarantees ... The Codex settings copy implied the cached credential was app-private. It is a normal login-Keychain item: reachable by programs running as you, with no per-app ACL. The real win is that it is no longer a world-readable 0644 file, so say that instead. Also documents why readAfterSecuringPermissions repairs permissions before validating content (validating first would read the secret while it is still world-readable, which is the window the function exists to close), and why the Keychain service names are deliberately not derived from CFBundleIdentifier (the Electron app hardcodes the same strings). Adds the #1037 changelog entry.		2026-08-19 11:43:44 -07:00
..
CodeBurnMenubar	docs(menubar): state what the Keychain move actually guarantees	2026-08-19 11:43:44 -07:00