Security

Token handling

Tokens are stored locally in the user config directory (config.json).
You can override tokens at runtime via --token or BLOCPAD_TOKEN to avoid writing secrets to disk in ephemeral environments.

Server-side requirements

The backend endpoints used by the CLI must:

Require authentication
Enforce project/task/page permissions
Apply row-level security (RLS) where applicable

Operational safety

The CLI is designed for safe, auditable workflows:

Prefer read-only exports for use with automation and AI tools.
When machine-readable output is requested (--json), stdout remains parseable (prompts go to stderr).