Please report suspected vulnerabilities privately through GitHub Security Advisories at https://github.com/excelano/graphauth/security/advisories/new. If you would rather not use GitHub, email david.anderson@excelano.com instead. I aim to respond within seven days.
Please do not open public issues for security problems.
The latest release receives security fixes. Older versions are not supported.
graphauth is a library, not a service. On behalf of the program that imports it, it talks over HTTPS to login.microsoftonline.com for device-code sign-in and token refresh, to graph.microsoft.com for whatever Graph requests the importing program makes, and to the addresses Graph hands back for moving file content, which are on the tenant's own SharePoint Online host: the redirect a download follows and the upload URL of a large-file upload session. It requests only the delegated permissions the importing program's app registration declares, and acts only as the signed-in user; the "Excelano SharePoint tools" registration it carries asks for Sites.ReadWrite.All. It runs no subprocesses and makes no network call to any other address.
A refresh token, in MSAL's cache format, at the path the importing program names; for the Excelano tools that is a file under ~/.config/excelano/ named for the app registration. The contents are encrypted at rest through atrest, under a key the operating system holds rather than one stored beside the file: DPAPI on Windows, deriving its key from the user's logon credentials; the user's D-Bus Secret Service on Linux, or the kernel's per-user keyring where no session bus or unlocked collection is reachable; the login Keychain on macOS. A copy of the file taken off that account, in a backup, a synced folder or a disk image, cannot be read. Where none of these is reachable — a container with no session bus and a kernel keyring blocked by its seccomp profile, a locked Keychain reached from outside the console user's own session — the file falls back to plaintext, and its only protection is then the file mode, 0600 in a 0700 directory, which keeps other accounts on the host out and does nothing for a copy. On every platform, any program running as the same user can read the token. Delete the file to force re-authentication; revoke the granted permission at https://myaccount.microsoft.com/applications to invalidate the token server-side. There is no telemetry, no analytics, and no remote logging.