The client secret is only intended for confidential client use (e.g. ephemerally, in CI). If set via onefuzz config, it will be serialized as part of the config, for convenient reuse in that setting. When serialized, default filesystem permissions secure it against other local users, but this lacks defense in depth. On a long-lived host, this is brittle.

Make misuse impossible: remove the client_secret field from the config altogether. When initializing a Onefuzz API instance, check an env var for a client secret (to allow "setting" the client secret once across multiple commands in CI). This means every CLI invocation will also perform this env lookup. Continue to allow passing / overriding the secret as a CLI argument, too.

Tested with a dev service principal and client secret:

• No secret (falls back on public client flow)
• Secret only in env var
• Secret only as parameter
• Secret as parameter overrides invalid env var
• Secret misplaced in config always ignored