·
1 commit
to main
since this release
Patch Changes
- 59a0fe1: Restrict the auth config file (
config.json) to mode0o600. The file holds OAuth access + refresh tokens and, during a pending login, adevice_code. Previously it inheritedconf's default (0o666masked by umask, typically0o644), which let other local users read the credentials and, during a login, race the legitimate poll loop to/device/token. Existing files are remediated automatically on the next config write.