Fix code scanning alert - File 'New-OAuthToken.ps1' uses ConvertTo-SecureString with plaintext. This will expose secure inf...

[JosephMcEvoy]

Tracking issue for:

• https://github.com/JosephMcEvoy/PSZoom/security/code-scanning/2

[andrew-hoggins]

Curious on your thoughts for this topic.
The error is due to you converting the plaintext token to a secure string.
I assume you are doing this for added security at rest as the token will be decrypted for every request.
The token in the response is in plaintext already so there is no way of securely receiving it.
By the time someone attempts to dump memory or review logs for the plaintext token, the token will no longer be valid.
I don't really see a way around using this command other than to remove it in favor of an always plaintext token.

ConvertTo-SecureString -string $token -plaintext