1 files changed, 20 insertions, 0 deletions
diff --git a/scripts/seed_pearl_workspace.py b/scripts/seed_pearl_workspace.py
index bc5300a..97079b6 100644
--- a/scripts/seed_pearl_workspace.py
+++ b/scripts/seed_pearl_workspace.py
@@ -41,6 +41,7 @@ Usage:
 import argparse
 import json
 import os
+import stat
 import sys
 import urllib.request
 
@@ -363,12 +364,31 @@ def seed(client):
             "default_issue_state": INTAKE_STATE if default_set else "unchanged"}
 
 
+def warn_if_key_file_world_readable(path, stream=None):
+    """Warn when PATH exists and is readable by group or others.
+
+    The key file holds a Linear API key, so group/other access is a leak risk.
+    Returns True when a warning was emitted, False otherwise (absent or 600)."""
+    if stream is None:
+        stream = sys.stderr
+    try:
+        mode = os.stat(path).st_mode
+    except OSError:
+        return False
+    if mode & (stat.S_IRWXG | stat.S_IRWXO):
+        print(f"warning: {path} is group/other-accessible; chmod 600 it "
+              "(it holds your Linear API key)", file=stream)
+        return True
+    return False
+
+
 def main(argv=None):
     parser = argparse.ArgumentParser(description="Seed a Pearl Linear workspace.")
     parser.add_argument("--dry-run", action="store_true",
                         help="print the reconcile plan without changing anything")
     args = parser.parse_args(argv)
 
+    warn_if_key_file_world_readable("apikey.txt")
     api_key = os.environ.get("LINEAR_API_KEY")
     if not api_key:
         print("LINEAR_API_KEY is not set", file=sys.stderr)