harden(security): chmod seed-admin-rotated.txt to 0600 (guarantee perms on overwrite)

2026-06-20 02:51:13 +02:00
parent 1c23c1fb60
commit 5107f63e60
1 changed files with 3 additions and 0 deletions
@@ -40,6 +40,9 @@ if (isMain) {
        // (on the bind-mount → visible on the host as data/seed-admin-rotated.txt).
        const outFile = path.join(path.dirname(dbPath), 'seed-admin-rotated.txt');
        fs.writeFileSync(outFile, `${r.newPassword}\n`, { mode: 0o600 });
+        // `mode` only applies when the file is newly created; chmod guarantees 0600
+        // even if a prior run left the file with looser permissions (it holds a password).
+        fs.chmodSync(outFile, 0o600);
        console.log('Seed admin password ROTATED.');
        console.log(`  New password: ${r.newPassword}`);
        console.log(`  Also written to: ${outFile} (delete after you have stored it)`);