{"repo":"NousResearch/hermes-agent","public_id":"16809","display_label":"File read/write access to sensitive credential paths","summary":"These issues and fixes concern gaps in file safety controls that may allow reading or writing sensitive paths such as SSH keys, .env files, shell history, and sibling-profile credential stores. Multiple vectors are identified including read_file, media delivery, and write operations under inactive profiles.","subsystem":"agent","counts":{"members":11,"open_issues":3,"open_issues_distinct":3,"open_prs":5,"closed_issues":2,"merged_prs":0,"attempt_prs":6},"landed_fix":null,"resolution":{"state":"unresolved","by":null},"freshness":{"state":"never_verified","last_verified_at":null,"is_stale":false},"grouping":{"backbone":"STRUCTURAL_PARTIAL","link_density":0.13527272727272727},"fix_edges":[],"members":[{"kind":"issue","number":16809,"title":"read_file has no sensitive-path deny list — SSH keys, .env, shell history readable without restriction","url":null,"state":"closed"},{"kind":"issue","number":20734,"title":"[Security]: get_read_block_error does not block project-local .env files, so read_file/ACP can read workspace secrets","url":null,"state":"closed"},{"kind":"issue","number":37617,"title":"security: agent/file_safety.py leaves inactive-profile credentials unprotected against prompt-injected writes","url":null,"state":"open"},{"kind":"issue","number":46411,"title":"Security: read_file can exfiltrate credential stores from sibling profiles","url":null,"state":"open"},{"kind":"issue","number":59044,"title":"Project-local .env/.envrc deliverable as native media (media denylist trails the read guard)","url":null,"state":"open"},{"kind":"pr","number":16851,"title":"fix(file-safety): refuse read_file on credential paths (SSH keys, .env, …) (#16809)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"f0db5c997d2ecc97c8dd26f28b1f6f71f5f9b01f","number":0},{"kind":"pr","value":"#16809","number":16809}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false,"is_fix_pr":true,"fix_tier":"suggested","fix_detail_withheld":true},{"kind":"pr","number":37624,"title":"fix(security): protect inactive-profile credentials from prompt-injected writes","url":null,"state":"open","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":37625,"title":"fix(file-safety): extend is_write_denied to cover inactive profile credentials","url":null,"state":"open","close_reason":{"refs":[{"kind":"pr","value":"#37624","number":37624},{"kind":"pr","value":"#37624","number":37624}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":46417,"title":"fix(security): block read_file credential access across sibling profiles","url":null,"state":"open","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":59045,"title":"fix(security): deny project-local .env/.envrc in media delivery","url":null,"state":"open","close_reason":{"refs":[{"kind":"pr","value":"#99182","number":99182},{"kind":"pr","value":"#99182","number":99182}],"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":68687,"title":"fix(agent): hard-deny still-protected stores under sibling profiles","url":null,"state":"open","close_reason":{"refs":[{"kind":"commit","value":"a77051a591b0","number":0},{"kind":"pr","value":"#37617","number":37617},{"kind":"pr","value":"#37624","number":37624},{"kind":"pr","value":"#37625","number":37625},{"kind":"pr","value":"#68687","number":68687},{"kind":"pr","value":"#37624","number":37624},{"kind":"pr","value":"#68687","number":68687},{"kind":"pr","value":"#37625","number":37625},{"kind":"pr","value":"#37624","number":37624},{"kind":"pr","value":"#68687","number":68687},{"kind":"pr","value":"#68687","number":68687},{"kind":"pr","value":"#37624","number":37624},{"kind":"pr","value":"#37625","number":37625},{"kind":"pr","value":"#68687","number":68687},{"kind":"pr","value":"#68687","number":68687},{"kind":"pr","value":"#37624","number":37624},{"kind":"pr","value":"#37625","number":37625},{"kind":"pr","value":"#68687","number":68687},{"kind":"pr","value":"#68687","number":68687},{"kind":"pr","value":"#374151","number":374151},{"kind":"pr","value":"#37617","number":37617},{"kind":"pr","value":"#68687","number":68687}],"category":"partial_fix","implication":"needs_llm"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}