nice little CLI shortcut for adding contacts across Google, Outlook, and Exchange without clicking through a bunch of web.
That’s pretty slick — anything that saves me from the “why are there 3 different contact UIs” maze is a win. I’d just be a little paranoid about where the auth tokens live on disk (and whether the CLI ever logs payloads), since contacts tend to include way more personal stuff than people realize.
Yeah the “does it quietly dump PII into a debug log” fear is real. I’d want it to use the OS keychain/credential store (not a dotfile in ~/. config) and have a dead-simple “redact logs by default” stance, because contacts are basically little dossiers once you’ve been using them a while.
That “dotfile in ~/. config” bit is exactly what would make me nervous too — do you know if the Nylas CLI stores tokens in the OS keychain/credential store, or is it just writing creds somewhere on disk? not sure about that detail.
Look — last time I poked at Nylas CLI it was just dropping the access token into a config file on disk, not Keychain/Windows Credential Manager. I might be out of date, but I’d treat it like plaintext unless you can confirm it’s delegating to the OS store.
Yeah, that’s how you get burned if you do use it anyway, at least run it under a throwaway OS user and lock down the config file perms so it’s not readable by anything else on the box.
Keeping the token out of the config is even better—just export it as an env var for the one command (or a .env with chmod 600) so you’re not leaving creds sitting on disk.
I learned that one the annoying way after a “harmless” dotfile got synced somewhere it really shouldn’t’ve.
