{"record":{"id":"6b7435b9f3f52c7f","repo":"unslothai/unsloth","slug":"credential-or-configuration-directories-are-not-br","errorCode":null,"errorMessage":"Credential or configuration directories are not browseable.","messagePattern":"Credential or configuration directories are not browseable\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"warning","filePath":"studio/backend/routes/models.py","lineNumber":1709,"sourceCode":"                    current,\n                    exc,\n                    exc_info = True,\n                )\n                raise HTTPException(\n                    status_code = 400,\n                    detail = \"Invalid path\",\n                ) from exc\n            if not _is_path_inside_allowlist(resolved_child, resolved_roots):\n                raise HTTPException(\n                    status_code = 403,\n                    detail = (\n                        \"Path is not in the browseable allowlist. Register it via \"\n                        \"POST /api/models/scan-folders first, or pick a directory \"\n                        \"under your home folder.\"\n                    ),\n                )\n            if contains_sensitive_path_component(str(resolved_child)):\n                raise HTTPException(\n                    status_code = 403,\n                    detail = \"Credential or configuration directories are not browseable.\",\n                )\n            if is_denied_system_path(str(resolved_child)):\n                raise HTTPException(\n                    status_code = 403,\n                    detail = \"System directories are not browseable.\",\n                )\n            current = resolved_child\n\n        if contains_sensitive_path_component(str(current)):\n            raise HTTPException(\n                status_code = 403,\n                detail = \"Credential or configuration directories are not browseable.\",\n            )\n        # Zero-component case: the requested path IS an allowlist root (legacy \"/\" or a drive root).\n        if is_denied_system_path(str(current)):\n            raise HTTPException(","sourceCodeStart":1691,"sourceCodeEnd":1727,"githubUrl":"https://github.com/unslothai/unsloth/blob/203007d19051dcd2ae33876786d117c99f6b0368/studio/backend/routes/models.py#L1691-L1727","documentation":"Raised as a 403 by _resolve_browse_target when contains_sensitive_path_component() flags a resolved intermediate component while walking toward the requested browse path. It blocks browsing through credential/configuration directories (e.g. .ssh, .aws, .gnupg, .config-style paths) even when those directories sit inside an allowed root like the home folder.","triggerScenarios":"GET browse-folders with a path that routes through or into a credential/config directory under home, e.g. ~/.ssh/keys, ~/.aws, or another directory whose name matches the sensitive-component list in storage/studio_db.","commonSituations":"Home directory used as a catch-all storage; users trying to verify a file inside .ssh or .gnupg via the models browser; exploratory browsing of dot-directories.","solutions":["Browse a non-sensitive directory instead — the browser is scoped to model/data folders by design.","Move the data you actually need out of the credential/config directory into a normal folder (or register that folder as a scan folder if appropriate).","Do not attempt to bypass it; use direct shell access for legitimate credential-file inspection."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"SENSITIVE = {'.ssh', '.aws', '.gnupg', '.config', '.kube', '.docker'}\n\ndef has_sensitive_component(path: str) -> bool:\n    return bool(SENSITIVE & set(path.strip('/').split('/')))\n\nif has_sensitive_component(browse_path):\n    raise ValueError('credential/config directories are not browseable')","typeGuard":null,"tryCatchPattern":"try:\n    entries = browse(path)\nexcept HTTPError as e:\n    if e.response.status_code == 403 and 'Credential' in e.response.json()['detail']:\n        show_user('That folder contains credentials and cannot be browsed here.')\n    else: raise","preventionTips":["Never store models/data inside credential or config directories.","Filter sensitive dot-directories out of the folder picker.","Treat this 403 as intentional; use shell tooling for credential-file work."],"tags":["security","filesystem","credentials","browse","allowlist"],"backgroundTag":null,"analyzedSha":"203007d19051dcd2ae33876786d117c99f6b0368","analyzedAt":"2026-08-15T02:48:39.846Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}