[benfrancom]

If github, take a look at gh cli or git credential manager:

https://docs.github.com/en/get-started/git-basics/caching-yo...

[progbits]

I wouldn't say that's better. Now your .config directory contains a github token that can do more than just repo pull/push, and it is trivially exfiltrated. Though similar thing could be said for browser cookies.