A news story about Claude account hijacking made me check my own VSCode auth tokens — and I found 27 of them sitting there. Here's what I learned, including a bug where the revoke feature didn't actually work for months.