This app requires a MiniMax API Key to function. The key is never included in this repository and never transmitted anywhere except to api.minimaxi.com / api.minimax.io.

The app stores your API key locally on your Mac at:

~/Library/Application Support/MiniMaxUsage/key

File permissions: 0600 (read/write for current user only).

This file is outside the project directory and is not tracked by git.

Before publishing or forking, verify no keys are present:

# Should produce no output
git grep -E "sk-cp-[A-Za-z0-9_-]{40,}" -- ':!*.md'

# Or with a stricter check
git grep -E "sk-(cp|api)-[A-Za-z0-9_-]+"

We also run this check automatically in CI (.github/workflows/ci.yml).

Immediately:

1. Revoke the key at https://platform.minimaxi.com/user-center/basic-information/interface-key
2. Create a new key
3. Purge from git history:

   # Using BFG Repo-Cleaner (recommended)
   bfg --delete-files "*.key"
   git reflog expire --expire=now --all
   git gc --prune=now --aggressive
   git push --force

4. Force all machines to re-sync the rewritten history

The app only makes GET requests to:

• https://api.minimaxi.com/v1/token_plan/remains (default)
• https://api.minimax.io/v1/token_plan/remains (international)

No data is sent to any other endpoint, telemetry service, or analytics platform.

The single outgoing request includes only:

• Authorization: Bearer <your-key> header
• Content-Type: application/json header
• No body, no other headers

If you discover a security issue, please open a GitHub Security Advisory instead of a public issue.