Automate setup commands put the access key on the command line (--key, --accessKey, -DBROWSERSTACK_ACCESS_KEY) #564

At 76ff1891fc0c09e351efb71d051ab70abc9c44ec (v2.6.5), the setup instructions that setupBrowserStackAutomateTests and setupBrowserStackAppAutomateTests return to the model pass the BrowserStack access key as a command-line argument:

• src/tools/sdk-utils/bstack/commands.ts:25: npx browserstack-node-sdk setup --username "<your_browserstack_username>" --key "<your_browserstack_access_key>"
• src/tools/sdk-utils/bstack/commands.ts:52 and :63: Maven -DBROWSERSTACK_ACCESS_KEY="<your_browserstack_access_key>"
• src/tools/sdk-utils/bstack/constants.ts:49: browserstack-sdk setup ... --key "<your_browserstack_access_key>"
• src/tools/sdk-utils/bstack/constants.ts:149 and :218: dotnet browserstack-sdk setup ... --accessKey "<your_browserstack_access_key>"

An agent following these instructions substitutes the real key into the command. A key in argv lands in shell history, in agent transcripts and in the process list of the machine running it.

The same package already recommends the safer route elsewhere. src/tools/sdk-utils/common/credentials.ts:14 mentions exporting BROWSERSTACK_USERNAME / BROWSERSTACK_ACCESS_KEY, and several other returned snippets use export BROWSERSTACK_ACCESS_KEY=... or process.env.BROWSERSTACK_ACCESS_KEY.

Request:

• Have the setup commands read the credentials from those environment variables, for example --key "$BROWSERSTACK_ACCESS_KEY" or no credential flags where the SDK reads the environment itself.
• Add a line telling the agent never to substitute a literal key into a command or into browserstack.yml.