[Security] Access token stored as plaintext in module scope is recoverable from same session

[cocallaw]

Summary

The API access token is stored as a plaintext string in $script:AccessToken. While the README describes this as isolated, any code running in the same PowerShell session can access module-scoped variables via the module object (e.g., & (Get-Module AzRetirementMonitor) { $script:AccessToken }).

Impact

For a published PSGallery module, any script, module, or profile code in the same session can silently read the token. This is a concern in shared automation environments or when running untrusted scripts alongside the module.

Location

• AzRetirementMonitor.psm1 — $script:AccessToken declaration
• Public/Connect-AzRetirementMonitor.ps1 — token storage
• README.md — documentation implies stronger isolation than exists

Suggested fix

Consider one or more of:

1. Fetch a fresh short-lived token per API call instead of caching it
2. Store only the auth context/method and acquire tokens on-demand
3. At minimum, revise docs to accurately state that module scope is not a security boundary within the same session

[cocallaw]

This has been addressed by PR #51, which was merged into the v3.0.0 branch. The documentation now accurately states that module scope is not a security boundary. This will land on main with the v3.0.0 release.