Current compile-time approach is correct for bootstrap architecture:
- Credentials only used during build
- Agent never sees them after
- No binary distribution
- Strings extraction is irrelevant threat
Obfuscation was over-engineering for this use case.
- build-obfuscated.sh: XOR encryption with random 256-bit key
- obfuscation/obfuscation.go: Runtime de-obfuscation package
- OBFUSCATION.md: Documentation and security comparison
- Prevents casual extraction with 'strings' command
- Medium security: Good for personal use, env vars for production