Found while dogfooding the current source with the locally built cdidx.
Several paths that can contain database snapshots, update state, or logs fall back to shared temp locations. Shared temp is acceptable only when the code creates a private directory with strict permissions and validates that invariant before writing sensitive material.
Evidence:
src/CodeIndex/ExportImportCommandRunner.cs stages export/import snapshot data under temp.src/CodeIndex/ProgramRunner.cs writes upgrade installer material under temp.src/CodeIndex/UpdateChecker.cs and src/CodeIndex/GlobalToolLog.cs use temp fallbacks for cache/log paths.
Suggested fix: prefer user-private app/cache directories for sensitive data, and when temp is unavoidable create a private per-run directory, enforce owner-only mode where supported, and fail closed if that guarantee cannot be established.
Found while dogfooding the current source with the locally built
cdidx.Several paths that can contain database snapshots, update state, or logs fall back to shared temp locations. Shared temp is acceptable only when the code creates a private directory with strict permissions and validates that invariant before writing sensitive material.
Evidence:
src/CodeIndex/ExportImportCommandRunner.csstages export/import snapshot data under temp.src/CodeIndex/ProgramRunner.cswrites upgrade installer material under temp.src/CodeIndex/UpdateChecker.csandsrc/CodeIndex/GlobalToolLog.csuse temp fallbacks for cache/log paths.Suggested fix: prefer user-private app/cache directories for sensitive data, and when temp is unavoidable create a private per-run directory, enforce owner-only mode where supported, and fail closed if that guarantee cannot be established.