[GH-ISSUE #1056] .env files generated with 644 permissions during repo clone – consider stricter defaults or config option #20068

New Issue

2026-06-07T17:33:45-05:00

GiteaMirror commented

2026-06-07 17:33:45 -05:00

Originally created by @meerumschlungen on GitHub (Dec 22, 2025).
Original GitHub issue: https://github.com/moghtech/komodo/issues/1056

When Komodo generates .env files during repository cloning, the file permissions are set as 644 which I feel bad about. Since .env files often contain secrets, world-readable (644) permissions could expose sensitive data if the repository directory is accessible to other users on the host.
Some considerations:

Is this done by design for any reason I do not see? I didn't find any reported issues or discussions about this.
The file probably gets created using the system's umask.
As a workaround I can use a On Pull command chmod 600 .env which works for me. However it is not ideal because I can't do this by default but only if environment variables are present. The command would fail if .env is not present. This way the hook can easily be forgotten to be implemented.
I did not test if the behavior is the same when generating environments from a stack resource (not using this since this breaks the capability to manage the Komodo-cloned stack from CLI, when it is not deployed via Komodo in the first place).

I'd like to request an option to set stricter permissions (e.g., 600) for generated .env files, or have them default to 600.

Originally created by @meerumschlungen on GitHub (Dec 22, 2025). Original GitHub issue: https://github.com/moghtech/komodo/issues/1056 When Komodo generates .env files during repository cloning, the file permissions are set as 644 which I feel bad about. Since .env files often contain secrets, world-readable (644) permissions could expose sensitive data if the repository directory is accessible to other users on the host. Some considerations: - Is this done by design for any reason I do not see? I didn't find any reported issues or discussions about this. - The file probably gets created using the system's umask. - As a workaround I can use a On Pull command `chmod 600 .env` which works for me. However it is not ideal because I can't do this by default but only if environment variables are present. The command would fail if .env is not present. This way the hook can easily be forgotten to be implemented. - I did not test if the behavior is the same when generating environments from a stack resource (not using this since this breaks the capability to manage the Komodo-cloned stack from CLI, when it is not deployed via Komodo in the first place). I'd like to request an option to set stricter permissions (e.g., 600) for generated .env files, or have them default to 600.

GiteaMirror commented

2026-06-07 17:33:47 -05:00

@mbecker20 commented on GitHub (Dec 22, 2025):

This change is already made in v2

@mbecker20 commented on GitHub (Dec 22, 2025): This change is already made in v2

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/komodo#20068