File history cache writes files with mode 0777 (world-writable)
Status Open
Maintainer reply None cached
Activity 0 comments · opened Aug 27, 2026
Description
Files under ~/.claude/file-history/<session-id>/* are created with mode777 (rwxrwxrwx) instead of a restrictive default like 644 or 600.
This directory holds cached copies of edited file content, which can include
project source and potentially sensitive data depending on what's being
edited.
Repro
- Edit any file in a Claude Code session.
stat -c "%a" ~/.claude/file-history/<session-id>/<hash>@v1- Observe mode
777rather than an owner-only mode.
Expected
File-history cache entries should be created with restrictive permissions
(e.g. 644 or 600), consistent with other sensitive Claude Code state
(~/.claude/sessions/*.key, ~/.claude/.credentials.json, etc. are
correctly 600).
Environment
- WSL2 (Linux 6.18.33.2-microsoft-standard-WSL2)
- Single local user; found during a routine local security audit.