Use the macOS `security` tool to manage [minor] secrets

readme.macos.md

cringe

export GITHUB_TOKEN=ghp_adiugaslhdg...
export IQAIR_API_KEY=oiheorhialjkfbld...

based

# add a new token called "cqsd/auth-only" for the "github" service to the macOS keychain
security add-generic-password -a cqsd/auth-only -s github -w

# recall it later
security find-generic-password -a cqsd/auth-only -s github -wg

now you can keep plaintext strings out...

export GITHUB_TOKEN=$(security find-generic-password -a cqsd/auth-only -s github -wg)
export IQAIR_API_KEY=oiheorhialjkfbld... # you can have this for free hehe