civo apikey save stores API key in a world-readable file.

[irgeek]

Using civo apikey save to save an API key creates a .civo.json file that is world readable:

hostname ~ $ ls -l ~/.civo.json
-rw-r--r--  1 user  group  234  5 Nov 13:45 /Users/user/.civo.json

At the very least that file should not have read permissions for the group and others, like this:

hostname ~ $ chmod go-r .civo.json
hostname ~ $ ls -l ~/.civo.json
-rw-------  1 user  group  234  5 Nov 13:45 /Users/user/.civo.json

[alejandrojnm]

I will check this, thank for let me know