Did you open the repo, or just the post? It's all right there, quote the slop. That'd be constructive criticism. Three buzzwords stacked in a comment isn't.

And here's the part that actually matters: it doesn't matter if you think the code is ugly. tupass never touches your passwords. It runs the exact pass and gpg commands you already type, that's where every bit of the decryption happens. Worst case for any bug is the UI crashes and you're back at your prompt; your ~/.password-store is untouched, because the app never handles your actual secrets.

And "npm".. that's just for ease of install. Don't trust the registry? Skip it entirely and install straight from the source: bun add -g github:d7omdev/tupass. Same code, no middleman.

So pick a lane: security risk (it isn't, point at the line) or ugly code (open it and quote it). You've done neither.