[security-fix] Fix incorrect file permissions for MCP gateway config containing API keys

[github-actions]

Security Fix: Incorrect File Permissions for MCP Gateway Config

Alert Number: #391
Severity: Medium
Rule: G306 - Expect WriteFile permissions to be 0600 or less

Vulnerability Description

The MCP gateway config file was being written with permissions 0644 (readable by all users), despite containing sensitive API keys in the Authorization headers. This could allow unauthorized users on the same system to read API keys from the config file.

Location: pkg/awmg/gateway.go:444

Fix Applied

Changed file permissions from 0644 to 0600 when writing the MCP gateway config file. This restricts access to the file owner only, preventing unauthorized access to sensitive API keys.

Changes:

• Modified os.WriteFile(configPath, data, 0644) to os.WriteFile(configPath, data, 0600)
• Added explanatory comment about why restricted permissions are needed

Security Best Practices

• Principle of Least Privilege: Config files containing sensitive credentials should have minimal permissions (0600 = owner read/write only)
• Defense in Depth: Even if the file is in a protected directory, restricting file permissions provides an additional security layer
• Compliance: Many security frameworks (PCI-DSS, HIPAA) require restricted permissions on files containing sensitive data

Testing Considerations

• Verify that the gateway can still read and write its config file with 0600 permissions
• Test that the config rewrite functionality works correctly after this change
• Confirm that non-owner users cannot read the config file

Impact

This is a minimal, surgical change that only affects the file permissions when writing the MCP gateway config. No functional changes to the code logic.

AI generated by Security Fix PR