Latest Results
Harden ~/.config/prisma-platform/auth.json file permissions to 0o600
CredentialsStore.writeCredentialsToDisk writes the Prisma Platform OAuth
tokens (token + refreshToken per workspaceId) to the auth file via
writeFile(this.authFilePath, JSON.stringify(data, null, 2)) with no mode
option. Node's default 0o666 masked by umask 022 gives 0o644 on macOS
Terminal and most Linux defaults, so the file ends up world-readable.
The surrounding directory was likewise being created at 0o755 via
mkdir(... { recursive: true }) with no mode.
Any local account or process that can traverse the home directory can
recover the token + refreshToken and call the Prisma Platform management
API as the user.
This commit:
- Adds `chmod` to the fs/promises imports.
- Passes `{ mode: 0o600 }` to writeFile and `{ mode: 0o700 }` to mkdir.
- Adds a follow-up chmod for both file and directory so pre-existing
installs converge to 0o600/0o700 on the next save. Per Node docs,
fs.chmod on Windows silently no-ops bits it cannot set, so no
try/catch wrapper is needed (and wrapping in catch would mask real
POSIX EPERM errors).
Mirrors industry-baseline credential-file handling (GitHub CLI, AWS CLI,
Google Cloud SDK, Stripe CLI, PlanetScale CLI's keyring fallback, Pulumi
StoreCredentials lockedfile.Write at 0o600).
Related disclosure: GHSA-cgq2-43wx-qgpq.JAE0Y2N:harden-credentials-store-perms Latest Branches
0%
jsumners-nr:add-otel-attribs +1%
barobaonguyen:fix/issue-1911-version-mismatch-warning 0%
aartoni:fix/adapter-pg-honor-schema © 2026 CodSpeed Technology