Source: Full code review 2026-07-17 (docs/reviews/2026-07-17-full-code-review.md), finding F11.
Category: security note · Severity: low · Effort: small
Problem
Any local user can read /proc/<pid>/cmdline, so passing the key via the -api-key flag (internal/config/config.go:318) leaks it to every process on the box — unlike the config file, which the installer correctly restricts to mode 640 root:pimonitor. README and docs/API.md mention the flag without a warning.
Suggested fix
Document that -api-key is for development only and the config file is the supported way to set the secret; optionally add a PIMONITOR_API_KEY environment variable as a middle ground (systemd Environment=/EnvironmentFile= friendly).
Source: Full code review 2026-07-17 (
docs/reviews/2026-07-17-full-code-review.md), finding F11.Category: security note · Severity: low · Effort: small
Problem
Any local user can read
/proc/<pid>/cmdline, so passing the key via the-api-keyflag (internal/config/config.go:318) leaks it to every process on the box — unlike the config file, which the installer correctly restricts to mode 640 root:pimonitor. README anddocs/API.mdmention the flag without a warning.Suggested fix
Document that
-api-keyis for development only and the config file is the supported way to set the secret; optionally add aPIMONITOR_API_KEYenvironment variable as a middle ground (systemdEnvironment=/EnvironmentFile=friendly).