From 96bef3ddd5ca55f8803f58eeaff06e6231e5ef27 Mon Sep 17 00:00:00 2001
From: Blake <28+blake@git.s1d3sw1ped.com>
Date: Mon, 14 Sep 2026 13:24:03 +0000
Subject: [PATCH] auth: Ignore tokens.json so Login output is not git-added

Login writes access/refresh tokens (and often client_secret) to
tokens.json at mode 0600. Without a gitignore entry, git add . after a
local login can stage live Agentic credentials.

Closes: https://git.s1d3sw1ped.com/s1d3sw1ped/robinhood-agentic-mcp/issues/20
---
 .gitignore | 3 +++
 README.md  | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 6f02b58..a80ca96 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,6 @@
 bin/
 *.exe
 coverage.out
+
+# OAuth tokens from auth.Login / WriteTokens (mode 0600 on disk)
+tokens.json
diff --git a/README.md b/README.md
index d306c7e..a4dbeb4 100644
--- a/README.md
+++ b/README.md
@@ -24,7 +24,7 @@ cfg := rh.Config{
 }
 ```
 
-Daemon/headless callers must not call `Login` (no browser). They call `Connect` with an existing token file (mode `0600`).
+Daemon/headless callers must not call `Login` (no browser). They call `Connect` with an existing token file (mode `0600`). Keep `tokens.json` out of git (listed in `.gitignore`).
 
 ## Example