Hardening: bash allowlist, plaintext credential storage, enforce https for token-bearing providers #10

New issue

Open

opened 2026-07-23 18:39:21 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-07-23 18:39:21 +00:00

Collaborator

Severity: Low / Informational — grouped hardening items from the security audit.

1. Tools grant full shell + filesystem, gated only by PermissionEngine

packages/core/src/tool/bash.ts runs bash -c <model string>; read/write/edit take arbitrary paths. Default config marks bash/edit/write as ask (packages/core/src/config/index.ts:11), but read/glob/grep/ls fall through to ?? "ask", and any tool can be set to allow. With bash: "allow", a prompt-injection payload in a file the model reads can trigger destructive commands with no gate.

Recommend: keep destructive tools deny/ask-by-default; consider a command allowlist for bash.

2. Credentials stored plaintext on disk

packages/core/src/auth/store.ts:5 — tokens live at ~/.config/thorny, protected only by 0600/0700. Modes are correctly re-clamped on existing files (packages/core/src/storage/index.ts:44).

Recommend: opt-in OS keychain backend (Keychain / libsecret / DPAPI).

3. Bearer token can be sent over cleartext http

packages/core/src/provider/openai-compatible.ts:73 attaches Authorization: Bearer to whatever baseUrl resolves to; base URLs come from config/env (packages/core/src/provider/catalog.ts:170-174) with no scheme enforcement. Defaults are https.

Recommend: reject http:// for any provider that carries a key (localhost excepted).

Dependency CVEs

bun audit on the current lockfile (238 entries; runtime deps: zod, commander, ink, ink-text-input, react) reports no vulnerabilities. No action needed; re-run in CI.

Found via security audit.

**Severity: Low / Informational** — grouped hardening items from the security audit. ### 1. Tools grant full shell + filesystem, gated only by PermissionEngine `packages/core/src/tool/bash.ts` runs `bash -c <model string>`; `read`/`write`/`edit` take arbitrary paths. Default config marks `bash/edit/write` as `ask` (`packages/core/src/config/index.ts:11`), but read/glob/grep/ls fall through to `?? "ask"`, and any tool can be set to `allow`. With `bash: "allow"`, a prompt-injection payload in a file the model reads can trigger destructive commands with no gate. - **Recommend:** keep destructive tools deny/ask-by-default; consider a command allowlist for `bash`. ### 2. Credentials stored plaintext on disk `packages/core/src/auth/store.ts:5` — tokens live at `~/.config/thorny`, protected only by `0600`/`0700`. Modes are correctly re-clamped on existing files (`packages/core/src/storage/index.ts:44`). - **Recommend:** opt-in OS keychain backend (Keychain / libsecret / DPAPI). ### 3. Bearer token can be sent over cleartext http `packages/core/src/provider/openai-compatible.ts:73` attaches `Authorization: Bearer` to whatever `baseUrl` resolves to; base URLs come from config/env (`packages/core/src/provider/catalog.ts:170-174`) with no scheme enforcement. Defaults are https. - **Recommend:** reject `http://` for any provider that carries a key (localhost excepted). ### Dependency CVEs `bun audit` on the current lockfile (238 entries; runtime deps: zod, commander, ink, ink-text-input, react) reports **no vulnerabilities**. No action needed; re-run in CI. Found via security audit.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

brodycritchlow/thorny#10

No description provided.

Rows
Columns