It's probably known but I was caught off guard yesterday when I noticed that Claude Code (CC) runs `gh auth token --hostname github.com` on every startup which typically returns raw token. e.g.

    $ gh auth token --hostname github.com
    gho_0000000000000000000000000000000000000000

I noticed this behaviour by chance when I configured gh to use 1Password for auth[1] and I kept getting prompted by 1Password for authorization repeatedly even when just launching an empty CC session.

I don't feel comfortable my GH token being read like that and since I use Nix to manage my system I quickly wrapped `gh auth token ..`[2] to return a fake token and so far nothing breaks.

However, I'd be interested to learn why is this behaviour the way its, does anybody have a clue?

[1] https://www.1password.dev/cli/shell-plugins/github [2] via pkgs.symlinkJoin