Secure tempfile permissions in encrypt_vault

[f3rdy]

Description

In vault.py encrypt_vault(), a temporary file with unencrypted YAML data is created with delete=False. The file permissions depend on the system umask and are not explicitly restricted.

If the process is killed between creating and encrypting, the unencrypted file remains on disk.

Proposed Solution

• Set explicit permissions to 0o600 on the temp file
• Use os.open() with restrictive mode or os.chmod() after creation
• Consider using NamedTemporaryFile with a custom opener

Files

• src/vaultctl/vault.py (lines 41-47)

Priority

P2

[f3rdy]

Resolved in master.