Backups: keep URL credentials out of git argv and the clone's .git/config (T332)

CHANGELOG.md

@@ -15,11 +15,13 @@ first added in the same Unreleased section is not an entry: edit that entry inst
 ### Changed
 
 - `tsk setup` names both installed skills, `tsk-cli` and `tsk-coordinator`, beside each agent's skills directory instead of printing only the `tsk-cli` file.
+- A backup URL with a user name, such as `https://org@host/…`, no longer asks your credential manager. Drop `org@` from the URL ([credentials](https://gettsk.sh/docs/storage/#credentials)).
 
 ### Fixed
 
 - A bare token in an https backup URL is removed and masked even when the URL does not start at the scheme.
 - An open board shows the update notice as soon as the release check finishes, and a board left open checks again once a day.
+- A token in a backup URL stays out of git's command line and the backup's local clone, so other local users cannot see it.
 
 ## v0.13.0
 

site/src/content/docs/docs/storage.md

@@ -273,6 +273,9 @@ Prefer ssh or a credential helper to a token in a backup URL. A URL such as `htt
 
 - `config.toml` keeps the URL as you wrote it, token included.
 - Backups never push the token: the pushed `config.toml` has it removed.
+- git gets the token privately, never on its command line or in the backup's local clone. Other local users cannot see it in the process list.
+- Any user name or token in the URL is the only login git tries for that target: your credential helper is not asked and stores nothing.
+- For Azure DevOps or Bitbucket URLs that start with a user name, such as `https://org@dev.azure.com/org/p/_git/tsk-backup`, leave the `org@` part out of the backup URL. Your credential manager (Git Credential Manager, osxkeychain) then logs you in.
 - Every command prints the URL with its credentials as `***`, such as `https://***@github.com/me/tsk-backup.git`. `tsk backup remove` takes that form too, unless two targets share it: then give the number or the full URL.
 
 ## Restore