[security] api_key_manager.py stores encryption key in plaintext .key file with no file permissions #706

New issue

Closed

opened 2026-06-02 23:56:44 +02:00 by sleepy · 0 comments

sleepy commented

2026-06-02 23:56:44 +02:00

Owner

File: src/api_key_manager.py

Problems:

No file permissions on the encryption key file (line 19): The .key file containing the Fernet encryption key is written with default permissions. No os.chmod(path, 0o600) or safe_chmod() call. Any user on the system can read the encryption key, making the encryption worthless.
No integrity verification (line 14): The key file is read blindly with no length/format validation. A truncated or corrupted key file silently produces a Fernet instance that can't decrypt existing data.
Plaintext encryption key at rest: The Fernet key itself is stored as raw bytes in .key. Compare with integrations.py which uses core.atomic_io and safe_chmod for its data file. The key file should have the same protection.
load() decrypts all keys on every call (lines 44–53): load() decrypts every stored API key and returns them as a dict. Callers get plaintext keys in memory. No access logging or audit trail.

Fix:

Call safe_chmod(key_file, 0o600) after writing the key
Validate key file size/content before use
Consider using the project's existing secret_storage module instead of a standalone Fernet instance

**File:** `src/api_key_manager.py` **Problems:** 1. **No file permissions on the encryption key file** (line 19): The `.key` file containing the Fernet encryption key is written with default permissions. No `os.chmod(path, 0o600)` or `safe_chmod()` call. Any user on the system can read the encryption key, making the encryption worthless. 2. **No integrity verification** (line 14): The key file is read blindly with no length/format validation. A truncated or corrupted key file silently produces a Fernet instance that can't decrypt existing data. 3. **Plaintext encryption key at rest**: The Fernet key itself is stored as raw bytes in `.key`. Compare with `integrations.py` which uses `core.atomic_io` and `safe_chmod` for its data file. The key file should have the same protection. 4. **`load()` decrypts all keys on every call** (lines 44–53): `load()` decrypts every stored API key and returns them as a dict. Callers get plaintext keys in memory. No access logging or audit trail. **Fix:** - Call `safe_chmod(key_file, 0o600)` after writing the key - Validate key file size/content before use - Consider using the project's existing `secret_storage` module instead of a standalone Fernet instance

sleepy referenced this issue from a commit

2026-06-03 15:59:01 +02:00

fix: secure .key file permissions and add integrity validation

sleepy referenced this issue from a pull request that will close it,

2026-06-03 16:00:12 +02:00

fix: secure .key file permissions and add integrity validation (#706) #803

sleepy closed this issue

2026-06-03 16:00:46 +02:00