From 7b645950eab7390603f02f40113a67740832bac6 Mon Sep 17 00:00:00 2001 From: gus Date: Mon, 6 Apr 2026 10:08:07 -0300 Subject: [PATCH] fix(design): restrict session file permissions to owner-only Design session files are written to /tmp without mode 0o600, making them world-readable on shared systems. Sessions contain originalBrief and feedbackHistory (user design prompts and iteration data). The rest of the codebase (16 locations in browse/src and design/src/auth.ts) correctly uses mode 0o600 for sensitive file writes. --- design/src/session.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/design/src/session.ts b/design/src/session.ts index 16d6f0eeab..7e9fe96e99 100644 --- a/design/src/session.ts +++ b/design/src/session.ts @@ -49,7 +49,7 @@ export function createSession( updatedAt: new Date().toISOString(), }; - fs.writeFileSync(sessionPath(id), JSON.stringify(session, null, 2)); + fs.writeFileSync(sessionPath(id), JSON.stringify(session, null, 2), { mode: 0o600 }); return session; } @@ -75,5 +75,5 @@ export function updateSession( session.outputPaths.push(outputPath); session.updatedAt = new Date().toISOString(); - fs.writeFileSync(sessionPath(session.id), JSON.stringify(session, null, 2)); + fs.writeFileSync(sessionPath(session.id), JSON.stringify(session, null, 2), { mode: 0o600 }); }