v0.35.1 — keep the Docker Hub credentials out of process argv The visibility step shipped in v0.35.0 passed the access token to jq as --arg and the session token to curl as -H. Both land in a process argument list, which /proc exposes to anything else on the machine. jq now reads the credentials from the environment, and the session token goes in a 0600 file passed as curl --config and removed on exit. No input or behaviour change. Anyone already on v0.35.0 should take this.