Some use Settings Sync or other tooling to share their settings in gists in Visual Studio Code.
I just noticed that the app registration token gets saved to the user settings file directly.
I believe this should be relocated to an extension local setting instead for better security, and preventing it from getting into any versioned settings history for a user.
The follow entries contain both my user name + application token.
powerShellUniversal.serverPath
powerShellUniversal.appToken
thanks!