Harden API key file loading

2026-08-10 18:24:29 +00:00
parent 363313d99c
commit 99b2e1cd81
13 changed files with 370 additions and 32 deletions
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -303,6 +303,9 @@ Windows access control.
 API keys are credentials, not ordinary workspace data. Store them outside the
 shared workspace or in a separately restricted credential location; ordinary
 workspace group access must never be treated as authorization to read keys.
+On POSIX, provision a credential directory as `0700` and credential files as
+`0600`; Narratio rejects group- or other-readable configured credential paths.
+On Windows, restrict the directory and files with ACLs to the credential owner.

 ## Cleanup