Potential fix for code scanning alert no. 5: Clear-text storage of sensitive information

[freedomsha]

Potential fix for https://github.com/freedomsha/taskcoach/security/code-scanning/5

The best way to fix the problem is to avoid storing the password in .pypirc in clear text entirely. Modern versions of setuptools and twine allow for authentication using environment variables, keyrings, or token-based mechanisms (API tokens). Therefore:

• General approach: Do not write the password into .pypirc. Instead, use environment variables or a keyring to pass credentials securely, if possible.
• Detailed fix:
  • Remove the line that writes the password to .pypirc: pypirc.write('password=%s\n' % password).
  • Preferably, update code to use twine for uploads, which never requires writing passwords to disk and supports secure authentication methods. If this is not possible, instruct users to use API tokens or set credentials via environment variables (TWINE_USERNAME, TWINE_PASSWORD).
  • If file-based credentials must be used, encrypt the file's contents using a secure cryptography library (e.g., cryptography.fernet) before writing.
  • At a minimum for legacy compatibility: replace the real password with a placeholder (and update documentation to guide secure authentication for PyPI).

File to change: taskcoach/release.py
Lines to change: Remove or replace the line writing the password to .pypirc (line 539).

Requirements:

• If removing password write, update the usage to provide credentials via secure means (document/comment the change).
• If encryption is chosen, add import for cryptography and method to encrypt/decrypt password before writing/using.
• Since we only see the relevant snippet, the minimum viable fix is to avoid writing the password line.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.