CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-08-22 05:57:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden file/directory permissions to owner-only (C5+H9+M9+M10)

Browse Source 
Add mode 0o700 to all mkdirSync calls for state/session directories.
Add mode 0o600 to all writeFileSync calls for session.json, chat.jsonl,
and log files. Add umask 077 to setup script. Prevents auth tokens, chat
history, and browser logs from being world-readable on multi-user systems.
Closes C5, H9, M9, M10 from security audit #783.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-04-04 21:22:12 -07:00
co-authored by Claude Opus 4.6
parent d41d605f4b
commit c7fc5e5ca9
4 changed files with 16 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
setup
+1
View File
@@ -1,6 +1,7 @@
#!/usr/bin/env bash
# gstack setup — build browser binary + register skills with Claude Code / Codex
set -e
umask 077 # Restrict new files to owner-only (0o600 files, 0o700 dirs)
if ! command -v bun >/dev/null 2>&1; then
echo "Error: bun is required but not installed." >&2