{"repo":"NousResearch/hermes-agent","public_id":"59726","display_label":"Restrict config.yaml file permissions to 0600","summary":"These issues and PRs address config.yaml remaining world-writable through write paths that bypass permission enforcement, with fixes proposed to cap file mode at 0600 in atomic write operations.","subsystem":"hermes_cli","counts":{"members":4,"open_issues":1,"open_issues_distinct":1,"open_prs":0,"closed_issues":0,"merged_prs":0,"attempt_prs":3},"landed_fix":null,"resolution":{"state":"unresolved","by":null},"freshness":{"state":"never_verified","last_verified_at":null,"is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[],"members":[{"kind":"issue","number":59726,"title":"config.yaml can stay world-writable indefinitely through ~10 write paths that bypass save_config()'s final chmod","url":null,"state":"open"},{"kind":"pr","number":59727,"title":"security(utils): cap config.yaml mode to 0600 in atomic_yaml_write","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"df714add9","number":0}],"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":59740,"title":"fix(utils): cap config.yaml mode at 0600 in atomic_yaml_write","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#59727","number":59727}],"category":"uncategorized","implication":"needs_llm"},"merged":false,"is_fix_pr":true,"fix_tier":"suggested","fix_detail_withheld":true},{"kind":"pr","number":60818,"title":"fix(config): secure direct YAML writes","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#59727","number":59727},{"kind":"pr","value":"#59726","number":59726}],"category":"duplicate_of","implication":"duplicate"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}