Development record
fsutil.EnsureHomeScope and OpenHomeScope judge each level of ~/.abcd.noindex for symlinks and swaps but not for owner or mode: a level that already exists keeps whatever mode it has, and one another account created (under a HOME planted outside every working tree) is written into. File contents stay 0600, so only names leak (an ideate verdict's date and slug, for example); the planting route is the harness's environment, not abcd. Found by the security review of iss-2610090740139804.
issueopenminoriss-2610140913332484
fsutil.EnsureHomeScope and OpenHomeScope judge each level of ~/.abcd.noindex for symlinks and swaps but not for owner or mode: a level that already exists keeps whatever mode it has, and one another account created (under a HOME planted outside every working tree) is written into. File contents stay 0600, so only names leak (an ideate verdict's date and slug, for example); the planting route is the harness's environment, not abcd. Found by the security review of iss-2610090740139804.
Frontmatter
| id | iss-2610140913332484 |
|---|---|
| type | issue |
| lifecycle | open |
| severity | minor |
.abcd/work/issues/open/iss-2610140913332484-fsutil-ensurehomescope-and-openhomescope.md
open on GitHub ↗ · commit history ↗
mentions2
- iss-2610090740139804abcd ideate record writes every verdict straight into the repository: a research note under .abcd/development/research/notes/ and a pointer line in .abcd/work/DECISIONS.md, both committed and public once pushed. The product thinker treats every idea put through ideate as secret: an idea and the sources it came from are kept private first and enter the repository only when the person decides it should.
- itd-2610140858048004abcd's home keeps itself out of a dotfiles repository