From 5107f63e60a6f4080e9ebdb4842a668555c42374 Mon Sep 17 00:00:00 2001
From: Jannis Braun <151788261+TheZwiss@users.noreply.github.com>
Date: Sat, 20 Jun 2026 02:51:13 +0200
Subject: [PATCH] harden(security): chmod seed-admin-rotated.txt to 0600
 (guarantee perms on overwrite)

---
 packages/server/src/scripts/remediate-seed-admin.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/packages/server/src/scripts/remediate-seed-admin.ts b/packages/server/src/scripts/remediate-seed-admin.ts
index 50f119cd..d25eaca3 100644
--- a/packages/server/src/scripts/remediate-seed-admin.ts
+++ b/packages/server/src/scripts/remediate-seed-admin.ts
@@ -40,6 +40,9 @@ if (isMain) {
         // (on the bind-mount → visible on the host as data/seed-admin-rotated.txt).
         const outFile = path.join(path.dirname(dbPath), 'seed-admin-rotated.txt');
         fs.writeFileSync(outFile, `${r.newPassword}\n`, { mode: 0o600 });
+        // `mode` only applies when the file is newly created; chmod guarantees 0600
+        // even if a prior run left the file with looser permissions (it holds a password).
+        fs.chmodSync(outFile, 0o600);
         console.log('Seed admin password ROTATED.');
         console.log(`  New password: ${r.newPassword}`);
         console.log(`  Also written to: ${outFile} (delete after you have stored it)`);