Security best practices for using Omni CLI safely.

• Credential Storage
• API Token Management
• Least Privilege
• Configuration File Security
• Network Security
• Audit and Monitoring
• Reporting Security Issues

Omni CLI stores configuration in ~/.config/omni/config.toml. This file may contain sensitive API tokens.

# Set restrictive permissions (read/write only for owner)
chmod 600 ~/.config/omni/config.toml

# Never commit this file
# Ensure .gitignore excludes it

In automated environments, use environment variables instead of writing tokens to disk:

export OMNI_HOSTINGER_API_TOKEN="your-token"
export OMNI_GITHUB_TOKEN="your-token"
export OMNI_UNLEASH_API_TOKEN="your-token"

• Generate a dedicated API token with minimal permissions
• Use separate tokens for production and development
• Rotate tokens every 90 days
• Never share tokens in chat, email, or version control

• Create tokens at https://github.com/settings/tokens
• Use fine-grained personal access tokens when possible
• Required scopes:
  • repo — for private repository access
  • read:user — for user information
  • read:org — for organization repositories (if needed)

• Use environment-specific tokens (dev, staging, production)
• Restrict token permissions to read-only unless toggling flags
• Rotate admin tokens regularly

Apply the principle of least privilege:

• Use read-only tokens for monitoring commands
• Use write tokens only when modifying infrastructure
• Create separate Omni CLI profiles for different environments
• Avoid using admin/root tokens for daily operations

Your config.toml should never be committed. Example safe setup:

hostinger_api_token = ""
github_token = ""
github_username = "mateussiqueira"
unleash_url = ""
unleash_api_token = ""
mcp_config_path = "~/.config/mcp/servers.json"
thunderbolt_disk = "/Volumes/ThunderboltSSD"

Set tokens via environment variables in production:

export OMNI_HOSTINGER_API_TOKEN=""
export OMNI_GITHUB_TOKEN=""
export OMNI_UNLEASH_API_TOKEN=""

• Only use trusted networks when transmitting API tokens
• Avoid using public Wi-Fi for infrastructure management
• Use a VPN when managing production resources remotely
• Ensure HTTPS is used for all API endpoints

Monitor usage of Omni CLI in shared environments:

# Enable command logging
export OMNI_LOG_LEVEL=INFO

# Review logs regularly
ls ~/.config/omni/logs/

If you discover a security vulnerability in Omni CLI, please:

1. Do not open a public issue
2. Email the maintainers directly
3. Provide a detailed description and reproduction steps
4. Allow reasonable time for disclosure

We take security seriously and will respond promptly.