# Release Announcement v0.3.0 (August 31 2023)

**URL:** https://discourse.flox.dev/t/release-announcement-v0-3-0-august-31-2023/791
**Category:** Announcements
**Created:** [August 31, 2023, 4:10pm UTC](https://discourse.flox.dev/t/release-announcement-v0-3-0-august-31-2023/791 "2023-08-31T16:10:19Z")
**Posts on this page:** 1
**Showing post:** 5

<div class="post-metadata">

### Author: ![limeytexan](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.flox.dev/limeytexan/32/10_2.png) [@limeytexan](https://discourse.flox.dev/u/limeytexan)
#### Post date: [September 4, 2023, 5:25pm UTC](https://discourse.flox.dev/t/release-announcement-v0-3-0-august-31-2023/791/5 "2023-09-04T17:25:05Z")

</div>

> [@anon59756714](#):
>
> I have question about flox-gh binary, why the only method of saving creds is saving it to disk? Is that a Nix problem that it does not connect to OS? With GH token being on the line I do not like the idea of using InsecureStorage.

Good question and thank you for highlighting! First things first - if you are at all concerned that your flox CLI token may have been compromised, please navigate to [your flox CLI OAuth App page](https://github.com/settings/connections/applications/b819ed5468f121e0286a) and select the `Revoke access` button.

Secondly, we completely agree - by way of background, we encountered a collision between the tokens being stored in the keychain for the `gh` app, employed a workaround as a temporary measure and neglected to return back to it. It was my mistake and it should only take a few hours to reinstate use of the keychain - I’ll get on that now and let you know when there’s a new version to test available in the `flox/prerelease` environment.

If it helps to allay your concerns, I also wanted to give some background to the `flox-gh` app. As I’m sure you’ve already realized `flox-gh` is a build of GitHub’s `gh` modified to authenticate against GitHub OAuth using a flox OAuth app ID which generates a separate token for the express purposes of authenticating with our flox cloud services. Notably, the token for this app has _no scope privileges_ as you can confirm by way of the `flox auth status` command:

```auto
flox [flox/prerelease default] [brantley@clubsoda:~/src/flox]$ flox auth status
github.com
  ✓ Logged in to github.com as limeytexan (/home/brantley/.config/flox/gh/hosts.yml)
  ✓ Token: gho_ ************************************
  ✓ Token scopes: none

```

This is _much_ different from the “gist, read:org, repo, workflow” scopes of tokens required by the `gh` app. For what it’s worth I am equally paranoid about the storage of those GitHub tokens!

Again, many thanks for highlighting this issue - I will get back to you with an update ASAP. 👍

---

_[View the full topic](https://discourse.flox.dev/t/release-announcement-v0-3-0-august-31-2023/791)._