gleam-lang/gleam

Set read-write permissions for the Hex credentials file when writing

Open

#5424 opened on Mar 4, 2026

View on GitHub
 (5 comments) (0 reactions) (0 assignees)Rust (21,417 stars) (960 forks)batch import
good first issuehelp wanted

Description

Currently we use the default umask, which may include it being world-readable. A best practice would be to set permissions to read-write for the user (0600 on Unix-like systems).

Contributor guide

Tech stack
rust
Domain
securitytooling
Issue type
security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Rust basicsUnix file permissions
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75
Research direction
Find the code that writes the Hex credentials file, likely in the Gleam compiler's source. Set file permissions to 0600 (owner read/write) using Rust's `std::fs::set permissions` or `PermissionsExt` on Unix. Consider Windows compatibility. Look for existing tests for credentials handling and add a test to verify the permissions.