> Lesson: the gh CLI is one of the highest-blast-radius credentials on a developer's machine. Wrapping it through a secret manager is the right control, and our policy now disallows direct use of gh CLI on developer machines altogether.

うーん、まあそう