Run this: cat ~/.cache/huggingface/token
That's your Hugging Face token. Plaintext. In a cache folder the kind that ends up in backups, rsyncs, and Docker COPYs.
jit 0.8.2 fixes it in one command:▎
jit wrap hf
Token vaulted, file scrubbed, hf keeps working as if nothing changed.
jitpass
/
jit
jit is an free CLI that finds the plaintext secrets scattered across a Mac and converts them into just-in-time, Touch-ID-gated credentials, without breaking anything that reads them.
jitpass: the jit CLI
Just-in-time credentials for your dev machine.
Documentation · Quickstart · Supported tools · Command reference · Security
Introduction
The problem. A working dev machine accumulates plaintext secrets: .env
files, export STRIPE_KEY=... lines in shell configs, ~/.aws/credentials
kubeconfig client keys, Terraform Cloud tokens, .npmrc auth tokens, MCP
server configs. Every one of them is readable by anything running as your
user, gets swept into backups and file indexes, and stays on disk long after
the moment you actually needed it.
What jit does. jit finds those secrets (jit audit, strictly
read-only), moves them into a local encrypted vault, and rewrites each file
so everything keeps working without the secret sitting on disk:
jit audit # what's exposed on this machine? (strictly read-only)
jit migrate local # fix this project; tools keep working
jit wrap gh # move a CLI's token into the vault; keep
Top comments (1)
I was surprised to see how easily accessible the Hugging Face token is, just by running
cat ~/.cache/huggingface/token. The fact that it's stored in plaintext and can end up in backups or Docker images is a significant security concern. Thejittool seems like a great solution to this problem, and the simplicity of runningjit wrap hfto vault the token is impressive. I'm curious to know more about howjithandles the token storage and retrieval under the hood, and whether it integrates well with other secret management tools.