File history cache writes files with mode 0777 (world-writable)

Status Open
Maintainer reply None cached
Activity 0 comments · opened Aug 27, 2026

Description
Files under ~/.claude/file-history/<session-id>/* are created with mode
777 (rwxrwxrwx) instead of a restrictive default like 644 or 600.
This directory holds cached copies of edited file content, which can include
project source and potentially sensitive data depending on what's being
edited.

Repro

  1. Edit any file in a Claude Code session.
  2. stat -c "%a" ~/.claude/file-history/<session-id>/<hash>@v1
  3. Observe mode 777 rather than an owner-only mode.

Expected
File-history cache entries should be created with restrictive permissions
(e.g. 644 or 600), consistent with other sensitive Claude Code state
(~/.claude/sessions/*.key, ~/.claude/.credentials.json, etc. are
correctly 600).

Environment

  • WSL2 (Linux 6.18.33.2-microsoft-standard-WSL2)
  • Single local user; found during a routine local security audit.

View original on GitHub ↗