If you discover a security vulnerability, please report it responsibly:

1. Do NOT open a public GitHub issue.
2. Email hasna@hasna.com with details.
3. Include steps to reproduce if possible.
4. Allow reasonable time for a fix before public disclosure.

@hasna/accounts stores everything locally in a single JSON registry under ~/.hasna/accounts/ (created with mode 600). It makes no network calls by default, sends no telemetry, and has no server component. Optional S3 registry sync is only used when HASNA_ACCOUNTS_S3_BUCKET or ACCOUNTS_S3_BUCKET is configured.

• Profile names, the tool each targets, an optional account email, the config-dir path, and timestamps.
• Apply mode may store auth snapshots under <profile-dir>/.accounts-auth/ (OAuth account JSON, file credentials, and on macOS a copy of the Keychain payload). Treat profile directories and ~/.hasna/accounts/accounts.json as sensitive — same trust level as ~/.claude or SSH keys.
• Optional S3 sync only writes the registry JSON snapshot by default. Auth snapshot files are not uploaded by the native storage helper.

Email auto-detection reads a tool's account file. accounts apply writes to live ~/.claude paths and may update the macOS Keychain entry Claude Code-credentials. Only run apply on profile dirs you trust.

accounts launch / accounts shell set the tool's config-dir environment variable and spawn the configured binary with your existing environment. Only register custom tools (accounts tools add) whose --bin you trust.

• Keep ~/.hasna/accounts/ on a filesystem with restricted permissions.
• Use --purge deliberately; it only deletes managed profile dirs, never imported ones.