When Komodo creates .env files for a stack, it creates them with default permissions, which usually means 0644. But since these files often contain sensitive data, they should not be world readable.
Komodo should create .env files with mode 0400 or 0440.
Originally created by @satwell on GitHub (Jul 21, 2025).
Original GitHub issue: https://github.com/moghtech/komodo/issues/671
When Komodo creates `.env` files for a stack, it creates them with default permissions, which usually means `0644`. But since these files often contain sensitive data, they should not be world readable.
Komodo should create `.env` files with mode `0400` or `0440`.
@stephanrenggli commented on GitHub (Oct 5, 2025):
This might have changed with newer versions?
On v1.19.5 the .env file is created with 0600 and additional env files such as secrets.env are created with 0644.
Edit: disregard the above, 1Password was recreating the file while injecting credentials.
<!-- gh-comment-id:3369423672 -->
@stephanrenggli commented on GitHub (Oct 5, 2025):
~~This might have changed with newer versions?~~
~~On v1.19.5 the `.env` file is created with `0600` and additional env files such as `secrets.env` are created with `0644`.~~
<img width="438" height="53" alt="Image" src="https://github.com/user-attachments/assets/f2fc54f4-c38e-4365-b0fc-3110c850cb06" />
**Edit: disregard the above, 1Password was recreating the file while injecting credentials.**
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @satwell on GitHub (Jul 21, 2025).
Original GitHub issue: https://github.com/moghtech/komodo/issues/671
When Komodo creates
.envfiles for a stack, it creates them with default permissions, which usually means0644. But since these files often contain sensitive data, they should not be world readable.Komodo should create
.envfiles with mode0400or0440.@stephanrenggli commented on GitHub (Oct 5, 2025):
This might have changed with newer versions?On v1.19.5 the.envfile is created with0600and additional env files such assecrets.envare created with0644.Edit: disregard the above, 1Password was recreating the file while injecting credentials.