Argos CLI Debug Mode Prints Your CI Tokens, and the Docs Tell You to Enable It
Two advisories I filed against argos-javascript: the documented debug flag dumps GITHUB_TOKEN and ARGOS_TOKEN into CI logs, and the OAuth login echoes attacker-controlled ANSI into your terminal. Both fixed within a day.