From fd5e954990e156d05c564f7b9ca6112f79ced544 Mon Sep 17 00:00:00 2001 From: Juan Camilo Date: Wed, 1 Apr 2026 15:34:37 +0200 Subject: [PATCH] fix: restrict .openclaude-profile.json permissions to owner-only (0600) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The profile file may contain API keys (OPENAI_API_KEY, CODEX_API_KEY, GEMINI_API_KEY) in plain text. Without explicit permissions, writeFileSync uses the process umask — on systems with permissive umask (0022), the file is world-readable (644), exposing credentials to other users. Relates to #24 Co-Authored-By: Juan Camilo --- scripts/provider-bootstrap.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/provider-bootstrap.ts b/scripts/provider-bootstrap.ts index 7e5d1f66..3640f378 100644 --- a/scripts/provider-bootstrap.ts +++ b/scripts/provider-bootstrap.ts @@ -123,7 +123,7 @@ async function main(): Promise { } const outputPath = resolve(process.cwd(), '.openclaude-profile.json') - writeFileSync(outputPath, JSON.stringify(profile, null, 2), 'utf8') + writeFileSync(outputPath, JSON.stringify(profile, null, 2), { encoding: 'utf8', mode: 0o600 }) console.log(`Saved profile: ${selected}`) console.log(`Path: ${outputPath}`)