Report it privately through GitHub rather than opening a public issue: go to the Security tab of ramo-io/ramo-cli and choose Report a vulnerability. That opens a private advisory visible only to you and the maintainers.

Include what someone needs to reproduce it: the version (ramo --version), the platform, and the shortest sequence of commands that shows the problem. Do not paste a real secret key or portal token into the report; the client redacts them from its own output, and a private advisory is still a copy.

This repository is the terminal client: the CLI verbs, the TUI, the SigV4 signer, and the credentials file it reads and writes. Findings in the hosted service behind api.ramo.io and s3.ramo.io can go through the same private advisory, and the maintainers route them onward.

Two behaviours are intended, not vulnerabilities. The credentials file holds a plaintext secret key, because it is the same shell-var format ramo.sh sources; it is written 0600. And the four RAMO_* environment variables override that file, because a caller who can set them can already read it.

An acknowledgement, then either a fix or an explanation of why the behaviour is intended. Please leave time for a fix to ship before disclosing publicly.

Development happens on main and releases are tags. Fixes land on main first; there is no separate maintenance branch.