"- API tokens are now stored only as hashes, which limits the impact of any similar incident."
WTF were they not already?
The number of systems that will show me the API token more than once makes me realize that many haven't figured out it is just a long password and should be treated exactly as such.
And you're absolutely right to push back on that.
[flagged]