Summary
Index lock metadata files include local process and workspace details, but they are written with default permissions and read without a size cap.
Evidence
src/CodeIndex/Cli/IndexLock.cs writes .info with File.WriteAllText(infoPath, SerializeInfo(info), Encoding.UTF8) and reads it via reader.ReadToEnd(). src/CodeIndex/Mcp/McpIndexRunLock.cs similarly writes _infoPath with File.WriteAllText and reads/parses File.ReadAllText(infoPath).
Impact
On shared systems, lock metadata can expose PID, host, and absolute project paths more broadly than intended. A bloated or corrupted .info file can also cause excessive allocation during stale-lock checks or diagnostics.
Suggested fix
Create lock metadata with owner-only permissions where supported, write atomically through the existing safe-write helpers if applicable, and enforce a small maximum read size before parsing.
Summary
Index lock metadata files include local process and workspace details, but they are written with default permissions and read without a size cap.
Evidence
src/CodeIndex/Cli/IndexLock.cswrites.infowithFile.WriteAllText(infoPath, SerializeInfo(info), Encoding.UTF8)and reads it viareader.ReadToEnd().src/CodeIndex/Mcp/McpIndexRunLock.cssimilarly writes_infoPathwithFile.WriteAllTextand reads/parsesFile.ReadAllText(infoPath).Impact
On shared systems, lock metadata can expose PID, host, and absolute project paths more broadly than intended. A bloated or corrupted
.infofile can also cause excessive allocation during stale-lock checks or diagnostics.Suggested fix
Create lock metadata with owner-only permissions where supported, write atomically through the existing safe-write helpers if applicable, and enforce a small maximum read size before parsing.