Fixed world-readable license keys on upgraded installs — v1.5.29
Posted by tomspark
SparkBox 1.5.29 ships with a critical fix for a permission regression in v1.5.28. When you upgraded, any state files that existed before the update kept their old file modes — which meant license.json stayed world-readable on some installs instead of locking down to 0o600. A one-shot startup migration now walks through state/ and fixes permissions on any file with group or other bits set, logging each repair so you can verify it ran. I also ran a full pentest against a fresh WSL2 install: 28 attack cases across two phases, covering everything from raw HTTP and WebSocket injection to state-file tampering. 27 came back safe. The one finding was the license-key visibility issue above — now patched. The full audit trail is in docs/PENTEST-REPORT-2026-04-21.md so you can see exactly what was tested and what wasn't. What changed: - License keys and other secrets in state/ now force 0o600 on startup if they're too permissive - Migration logs each file it fixes to state/migrations.log - Full pentest report committed; all 28 attack cases documented Head to the Updates tab in your dashboard to pull 1.5.29. If you see permission errors or unexpected log entries after upgrade, post them here in d/sparkbox. --- Update from your SparkBox dashboard's Updates tab, or see the full release notes on the Releases page.