Description
~/.railway/config.json stores live credentials (user.accessToken, user.refreshToken, user.token), but the CLI writes it with mode 0644 (world-readable). Every rewrite — login, project link, MCP server activity — resets the file to 0644 even if the user has previously tightened it to 0600, because the file is replaced wholesale (new inode each time).
Expected
Credential-bearing files should be created 0600, matching peer CLIs:
gh writes ~/.config/gh/hosts.yml at 0600- AWS CLI writes
~/.aws/credentials at 0600
kubectl warns loudly when a kubeconfig is group/world-readable
Reproduce
$ railway login # or any command that rewrites config
$ stat -f "%Sp" ~/.railway/config.json
-rw-r--r--
$ chmod 600 ~/.railway/config.json
# ... any subsequent CLI/MCP activity that rewrites config ...
$ stat -f "%Sp" ~/.railway/config.json
-rw-r--r--
Environment
- railway 5.23.1 (Homebrew), macOS 15.x
- Observed via both direct CLI use and
railway mcp server activity
The fix is presumably a 0o600 mode on the config file create (and ideally an umask-independent explicit set_permissions on the rename-into-place path, since the file is replaced rather than truncated).
Description
~/.railway/config.jsonstores live credentials (user.accessToken,user.refreshToken,user.token), but the CLI writes it with mode0644(world-readable). Every rewrite — login, project link, MCP server activity — resets the file to0644even if the user has previously tightened it to0600, because the file is replaced wholesale (new inode each time).Expected
Credential-bearing files should be created
0600, matching peer CLIs:ghwrites~/.config/gh/hosts.ymlat0600~/.aws/credentialsat0600kubectlwarns loudly when a kubeconfig is group/world-readableReproduce
Environment
railway mcpserver activityThe fix is presumably a
0o600mode on the config file create (and ideally an umask-independent explicitset_permissionson the rename-into-place path, since the file is replaced rather than truncated).