But now you have the only credential, the REPO_TOKEN in plaintext in your .git/config file. That's even worse.Edit: typo
I don't want to watch the video on "why this app is better than fdroid". So, does anyone care to write an TL;DR?
Make them non-admins and make the "difficult dashboard" admin-only. At least that is my way of doing it.
You could add keepassxc as an option for those who don't want a hosted service at all. You can still exchange the storage file with other computers if you have to (via USB stick, mail, nextcloud etc)
Disable bluetooth on your phone, have a call and see if they react to it. If they do react, you can rule out bluetooth snitching on you.
May someone wooosh me?