fix(security): restrict settings.json permissions and stop caching the raw apiKey - #359

Open

raymondginger2018-sudo wants to merge 4 commits into

lessweb:mainfrom

raymondginger2018-sudo:pr/private-storage-and-key-hash

Commits on Sep 25, 2026

fix(security): write settings.json with user-only permissions
raymondginger2018-sudo
committed
7227861
fix(security): hash the apiKey in the OpenAI client cache key
raymondginger2018-sudo
committed
1e8d52a
fix(security): apply the settings ACL for real and assert it
raymondginger2018-sudo
committed
1e5d6b7

Commits on Sep 27, 2026

fix(security): grant the Windows ACL before stripping inheritance

raymondginger2018-sudo
authored and
Raymo
committed
e81a10a