CLI flags containing credentials (--api-key, --api-password) are visible in process listings. Use environment variables instead:
| CLI flag | Environment variable |
|---|---|
--api-key |
VARIA_API_KEY |
--api-user |
VARIA_API_USER |
--api-password |
VARIA_API_PASSWORD |
--model-api-key |
VARIA_MODEL_API_KEY |
When using --cache, revision content is persisted to ~/.refract/cache.db (SQLite). This file contains full wikitext from every revision fetched. On shared machines, configure --cache-dir to an encrypted volume.
The cache directory can also be set via VARIA_CACHE_DIR environment variable.
Refract makes outbound HTTPS requests to the configured MediaWiki API. Authentication tokens are sent as Authorization or x-api-key headers. All traffic is encrypted in transit.
Bundled evidence files (--bundle) are signed but not encrypted — they contain plaintext event data with a SHA-256 hash for integrity verification.
Cached revision data persists indefinitely in ~/.refract/cache.db. Clear it manually:
rm -rf ~/.refract/cache.dbThere is no automatic data retention policy. The cache only contains data you explicitly fetched.