Security: API keys stored in world-readable plaintext config file

[vineet1cg]

Description

API keys for Groq and Google Gemini are stored in a plaintext JSON file at ~/.repo2readme_env.json with default system umask permissions. Any process or user on the same machine can read this file and steal both API credentials.

File

repo2readme/config.py (line 15-17)

Current Behavior

def save_env(data):
    with open(ENV_PATH, "w") as f:
        json.dump(data, f, indent=4)
    # No permission restriction - file is created with default umask

Expected Behavior

The config file should be readable only by the owner.

Proposed Fix

Add os.chmod(ENV_PATH, 0o600) after writing the file:

def save_env(data):
    with open(ENV_PATH, "w") as f:
        json.dump(data, f, indent=4)
    os.chmod(ENV_PATH, 0o600)  # Owner read/write only

Impact

Prevents credential leakage to other users/processes on multi-user systems or compromised containers.

Additional Context

Import os is already imported in config.py. This is a 2-line fix with no side effects.

[Diwakar-odds]

Hi maintainers! I'd like to take up this critical security vulnerability. I will migrate the hardcoded plaintext API keys to environment variables loaded via \dotenv, update the configuration logic to assert their presence at runtime, and add the config file to .gitignore. Could you please assign this to me under the ECSoC '26 program?

[Diwakar-odds]

Hello! I would like to work on this issue as well. Could you please assign it to me?

As this appears to be a core/L3 feature, here is my proposed implementation plan:

Implementation Plan

1. Analysis: Review the relevant files and trace the current execution path to ensure no side effects.
2. Implementation: Apply the necessary code changes/fixes according to the acceptance criteria.
3. Testing: Write/update unit tests to verify the fix and ensure existing tests pass.

Files to be Modified

• Relevant core service files related to this issue.
• Associated test files.

Could you also please apply the ECSoC26 label to this issue so it can be tracked for the contribution program? Thank you!