Please report vulnerabilities privately through GitHub's security-advisory feature rather than opening a public issue.

This tool intentionally creates a second, automation-readable generic-password item. That copy has a weaker security posture than credentials protected by Passwords/iCloud Keychain user-presence checks.

• Use a narrowly scoped service and account selector.
• Trust only the executable paths that need access.
• Remember that trusting /usr/bin/security allows any process running as the same user to invoke that binary and request the copied credential; it does not identify the original caller.
• --trusted-app values must be absolute paths to existing executables, and supplying the option replaces the default ACL entry rather than supplementing it.
• store refuses to update an existing item because security -U cannot be relied on to remove older ACL entries; explicitly delete and recreate a copy when its ACL must change.
• The default user Keychain is resolved before storing, and subsequent check/delete operations target that cached path rather than the broader Keychain search list.
• Do not use -A (allow every application).
• Never put a real secret after security ... -w on a command line.
• Never enable shell tracing while retrieving a secret.
• Do not print, hash, log, or serialize retrieved values.
• Delete copies that are no longer needed.

The project does not retrieve or modify an original Passwords/iCloud Keychain credential. Users manually enter the value that should be stored in the new generic-password item.