Long-lived credential in env, no refresh flow
Code reads credentials from env but never calls a refresh_token flow.
What it means
patchbay found environment variables with names matching KEY|TOKEN|SECRET|PASSWORD being read in source, but no code path that handles OAuth refresh tokens. This means the credential rotates only when someone manually updates the env, which in practice is never. Long-lived credentials in env are the most common leak path for connectors because they end up in Docker images, CI logs and backup files.
How to fix
Switch to OAuth 2.1 with refresh tokens. Store only the refresh token; derive access tokens from it on each run with a short TTL. Rotate the refresh token on every refresh.
Run the check against your own server:
npx -y @patchbay-nebius/agent audit <url-or-directory>No install: scan an MCP server in the browser and get a shareable report.
Disagree with this finding on your server? Open an issue with the --json output. False-positive reports are the most useful feedback.