{"record":{"id":"38321a81af7ba316","repo":"unslothai/unsloth","slug":"credential-or-configuration-directories-are-not-al","errorCode":null,"errorMessage":"Credential or configuration directories are not allowed","messagePattern":"Credential or configuration directories are not allowed","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"warning","filePath":"studio/backend/core/rag/folder_sync.py","lineNumber":159,"sourceCode":"    from hub.storage.scan_folders import (\n        contains_sensitive_path_component,\n        is_denied_system_path,\n    )\n    from utils.paths.external_media import is_local_filesystem_root\n\n    if not os.path.isdir(normalized):\n        raise ValueError(\"Path must be a directory, not a file\")\n    if not os.access(normalized, os.R_OK | os.X_OK):\n        raise ValueError(\"Path is not readable\")\n    if is_local_filesystem_root(normalized):\n        raise ValueError(\"The filesystem root cannot be registered\")\n    try:\n        if Path(normalized) == Path.home().resolve():\n            raise ValueError(\"The entire home folder cannot be registered\")\n    except RuntimeError:\n        pass\n    if contains_sensitive_path_component(normalized):\n        raise ValueError(\"Credential or configuration directories are not allowed\")\n    if is_denied_system_path(normalized):\n        raise ValueError(\"System directories are not allowed\")\n    return normalized\n\n\ndef _root_identity(root: str) -> tuple[int, int]:\n    try:\n        root_stat = os.lstat(root)\n    except OSError as exc:\n        raise RuntimeError(\"Linked folder is unavailable\") from exc\n    if stat.S_ISLNK(root_stat.st_mode) or not stat.S_ISDIR(root_stat.st_mode):\n        raise RuntimeError(\"Linked folder is no longer a regular directory\")\n    if os.path.normcase(os.path.realpath(root)) != os.path.normcase(root):\n        raise RuntimeError(\"Linked folder no longer resolves to its registered path\")\n    return root_stat.st_dev, root_stat.st_ino\n\n\ndef _store_identity(identity: tuple[int, int]) -> tuple[int | str, int | str]:","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/unslothai/unsloth/blob/203007d19051dcd2ae33876786d117c99f6b0368/studio/backend/core/rag/folder_sync.py#L141-L177","documentation":"ValueError raised when contains_sensitive_path_component(normalized) finds a path component associated with credentials or application configuration (e.g. .ssh, .gnupg, .aws, .config, .kube, AppData). Such folders hold secrets and tokens, and ingesting them into a searchable RAG store would leak secrets into embeddings and query results, so they are denied by component name anywhere in the path.","triggerScenarios":"Registering /home/user/.ssh, /home/user/.config, or any folder nested under such a component (e.g. /home/user/.config/myapp/data); paths where a parent directory happens to be named .aws or similar; Windows AppData-based paths.","commonSituations":"Apps that store documents under .config or AppData and users trying to index them; symlink-free but sensitive dotfolders; portable-app layouts under .local/share misconfigured as .config.","solutions":["Move the documents you want indexed out of credential/config directories into a normal folder.","If the data legitimately lives there, copy (not link) the specific document subfolder to a non-sensitive location and register that.","Review the component list in hub.storage.scan_folders.contains_sensitive_path_component for your version to know exactly what is blocked."],"exampleFix":"# before\nvalidate_folder_path('/home/me/.config/myapp/notes')\n\n# after\n# copy notes to a regular folder first\nvalidate_folder_path('/home/me/Documents/notes')","handlingStrategy":"validation","validationCode":"from hub.storage.scan_folders import contains_sensitive_path_component\nimport os\n\ndef folder_has_no_sensitive_components(path: str) -> bool:\n    normalized = os.path.realpath(os.path.abspath(os.path.expanduser(path)))\n    return not contains_sensitive_path_component(normalized)","typeGuard":null,"tryCatchPattern":"try:\n    validate_folder_path(path)\nexcept ValueError as e:\n    if \"Credential or configuration\" not in str(e):\n        raise\n    return bad_request(\"that folder contains credentials/config; move documents to a normal folder\")","preventionTips":["Never store user documents under dot-config/AppData trees you also want indexed.","Block obvious sensitive components (.ssh, .aws, .gnupg, .config, AppData) in the client browser.","Treat this error as a security control — do not attempt workarounds."],"tags":["security","paths","secrets","validation"],"backgroundTag":null,"analyzedSha":"203007d19051dcd2ae33876786d117c99f6b0368","analyzedAt":"2026-08-15T02:48:39.846Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}