In config.py, save_config() writes the configuration file (which contains github_token and optionally anthropic_api_key) using Path.write_text() with default permissions (typically 0644, world-readable). The parent directory is also created with default permissions.
Suggested fix: Use a temporary file + atomic rename pattern, and explicitly set file permissions to 0o600 (owner-read/write only) after writing. Set directory permissions to 0o700. This prevents other users on the system from reading stored credentials.
Identified by minbot code review
In config.py, save_config() writes the configuration file (which contains github_token and optionally anthropic_api_key) using Path.write_text() with default permissions (typically 0644, world-readable). The parent directory is also created with default permissions.
Suggested fix: Use a temporary file + atomic rename pattern, and explicitly set file permissions to 0o600 (owner-read/write only) after writing. Set directory permissions to 0o700. This prevents other users on the system from reading stored credentials.
Identified by minbot code review