Please do not open a public issue for security problems.

Report privately through GitHub: open the repository's Security tab → Report a vulnerability (GitHub private vulnerability reporting). Include:

• a description of the issue
• steps to reproduce
• potential impact

We will acknowledge the report as soon as possible and coordinate a fix and disclosure timeline with you.

• Credentials are stored locally in ~/.threads/.env (mode 0600) and are never printed to stdout/stderr by the CLI. Never paste real tokens into issues or PRs.
• The official Threads API passes the access token as a request parameter; this is inherent to the Graph API, not specific to this tool.