Security: 7 low-severity findings in the CLI #1021

CodeRabbit's historical security scan of this repository (scan e8c825ec-84c1-4a90-b646-61791714baf8, revision bc22677aba, generated 2026-11-01) reported this. It is an AI-generated finding, not a confirmed vulnerability: reachability is not established by the scan, and the report itself says so. Triage before treating it as exploitable.

F-015 — sensitive data exposure (low)

src/cli/utils/env-config.ts:202-203

The default environment-output policy identifies secrets only through selected key-name substrings. Supported database and Redis connection URIs bypass that classifier, so embedded passwords are printed without an explicit request to reveal secrets.

Evidence

• Source/control: Credential-bearing DB_URI or REDIS_URI values read from the operator's environment file.
• Sink/decision: …

Suggested fix. Treat DB_URI and REDIS_URI as sensitive, or remove their authentication components before default output. Use the same redaction policy for both list and get.

F-016 — sensitive data exposure (low)

src/cli/commands/update.ts:20-20

Update includes every nonignored untracked file in a Git stash, including private runtime files under nginx/ssl. Git storage and restoration do not preserve owner-only read permissions, so another local account can gain access to a previously protected private key.

Evidence

• Source/control: An untracked, security-relevant TLS private key under nginx/ssl that the updating operator can …

Suggested fix. Exclude private runtime directories from Git operations and replace the blanket untracked-file stash with an explicitly bounded update strategy. If a live key was exposed through this path, rotate it and remove accessible retained Git copies.

F-022 — injection (low)

src/cli/commands/info.ts:247-247

The human-readable info command prints remotely editable relay metadata without escaping terminal controls. A settings administrator can insert line breaks or escape sequences that forge diagnostic output and, on terminals permitting OSC 52 writes, replace the operator’s clipboard.

Evidence

• Source/control: The info.name value submitted to authenticated PATCH /admin/settings.
• …

Suggested fix. Escape terminal control characters, including embedded newlines, carriage returns, ESC and C1 controls, before interpolating metadata into human-readable output. Preserve JSON serialization for machine-readable output.

F-023 — sensitive data exposure (low)

src/cli/commands/setup.ts:136-136

Setup creates a missing environment file using default permissions when no template exists, then stores SECRET without restricting those permissions. With umask 022, unrelated local users can read the secret if they can traverse the project directory.

Evidence

• Source/control: The deployment secret selected or generated by resolveSecret during operator-invoked setup.
• Sink/decision: …

Suggested fix. Create .env with mode 0600 and restrict its permissions before writing SECRET. Apply the same protection when copying a template or updating an existing file.

F-035 — sensitive data exposure (low)

src/cli/utils/env-config.ts:181-181

The environment setter creates credential files without specifying owner-only permissions. With umask 022, a newly created file exposes its deployment credentials to other local accounts that can traverse the project directory.

Evidence

• Source/control: An operator supplies SECRET or another supported private credential to config env set.
• Sink/decision: upsertEnvValue calls …

Suggested fix. Create the environment file with mode 0600 and restrict existing permissions before writing credentials. Keep this protection in the writer so every caller receives it.

F-042 — authorization bypass (low)

src/cli/utils/bootstrap.ts:22-23

CLI bootstrap creates a higher-precedence settings.yaml containing defaults even when supported legacy settings.json already defines the relay’s access policy. Starting that deployment silently disables its configured admission restrictions and permits nonmembers to publish events.

Evidence

• Source/control: A nonmember’s valid, self-signed WebSocket EVENT after bootstrap shadows the …

Suggested fix. Copy defaults only when neither settings.yaml nor settings.json exists. If migrating legacy JSON, preserve its overrides in the resulting YAML before making that file authoritative.

F-043 — sensitive data exposure (low)

src/cli/commands/setup.ts:136-136

Setup stores SECRET without enforcing private file permissions. Its no-template creation branch, and the environment editor’s file-creation path, use ordinary creation permissions, allowing another local account to read credentials when the umask and directory permissions permit it.

Evidence

• Source/control: Generated or operator-supplied SECRET and private values written through config env …

Suggested fix. Create environment files with mode 0600 and restrict existing files before writing private values. Apply the policy consistently to setup, template copying and environment editing.

These are grouped by area so one reviewer can judge them together; split any that turn out to need separate work.