AIKIDO-2026-10216

TL;DR

Affected versions of opencode-antigravity-auth store credential files with overly permissive file system permissions, allowing other local users or processes on the same system to read or modify sensitive authentication data. This could result in unauthorized access to stored tokens and credentials used for OAuth authentication against Antigravity. The issue is fixed by explicitly setting secure file permissions (0600) for credential storage to ensure only the owning user can read or write these files, reducing the risk of local credential disclosure.