If you've got a GITHUB_TOKEN sitting in plaintext in your .zshrc right now, this one's for you. And if you've never actually looked inside your .npmrc , I'd bet money there's an _authToken=npm_xxxxxxxx line in there that's been quietly rotting since you set it up two jobs ago. I found both of these problems in my own dotfiles last week, despite having the 1Password CLI installed for months. Turns out "having the tool" and "actually using the tool" are very different states of being. ...