config.go loads api_url and credentials from $XDG_CONFIG_HOME/autotask-mcp/config.json. saveFileConfig uses MkdirAll(dir, 0700), which does not tighten an already more-permissive existing directory, and checkSecureFilePermissions only prints a warning for insecure file permissions rather than refusing to load. An attacker who can write config.json can inject a malicious api_url and redirect requests carrying environment-provided credentials to their own endpoint.
Consider validating the config directory ownership and mode, treating insecure permissions as fatal (or at least never loading a group/world-writable config), and constraining api_url to an approved HTTPS host.
Found during post-merge review (see PR #38).
config.go loads api_url and credentials from $XDG_CONFIG_HOME/autotask-mcp/config.json. saveFileConfig uses MkdirAll(dir, 0700), which does not tighten an already more-permissive existing directory, and checkSecureFilePermissions only prints a warning for insecure file permissions rather than refusing to load. An attacker who can write config.json can inject a malicious api_url and redirect requests carrying environment-provided credentials to their own endpoint.
Consider validating the config directory ownership and mode, treating insecure permissions as fatal (or at least never loading a group/world-writable config), and constraining api_url to an approved HTTPS host.
Found during post-merge review (see PR #38).