{"record":{"id":"7a8fe6c1bc0a56a7","repo":"unslothai/unsloth","slug":"credential-or-configuration-directories-are-not-al-7a8fe6","errorCode":null,"errorMessage":"Credential or configuration directories are not allowed","messagePattern":"Credential or configuration directories are not allowed","errorType":"validation","errorClass":"ValueError","httpStatus":400,"severity":"warning","filePath":"studio/backend/hub/storage/scan_folders.py","lineNumber":135,"sourceCode":"\ndef add_scan_folder_with_status(path: str) -> tuple[dict, bool]:\n    \"\"\"Add a readable scan folder and return its row plus whether it was inserted.\"\"\"\n    if not path or not path.strip():\n        raise ValueError(\"Path cannot be empty\")\n    normalized = os.path.realpath(os.path.expanduser(normalize_path(path.strip())))\n\n    if not os.path.exists(normalized):\n        raise ValueError(\"Path does not exist\")\n    if not os.path.isdir(normalized):\n        raise ValueError(\"Path must be a directory, not a file\")\n    if not os.access(normalized, os.R_OK | os.X_OK):\n        raise ValueError(\"Path is not readable\")\n    if is_local_filesystem_root(normalized):\n        # A local fs root (\"/\", \"C:\\\\\") would expose denied system dirs via browse;\n        # a UNC share root (\\\\server\\share) has none under it and stays registerable.\n        raise ValueError(\"The filesystem root cannot be registered\")\n    if _contains_sensitive_path_component(normalized):\n        raise ValueError(\"Credential or configuration directories are not allowed\")\n\n    is_win = platform.system() == \"Windows\"\n    check = os.path.normcase(normalized) if is_win else normalized\n    for prefix in _denied_path_prefixes():\n        if check == prefix or check.startswith(prefix + os.sep):\n            if prefix == \"/run\" and is_linux_run_media_path(check):\n                continue\n            raise ValueError(f\"Path under {prefix} is not allowed\")\n\n    conn = get_connection()\n    try:\n        _ensure_schema(conn)\n        now = datetime.now(timezone.utc).isoformat()\n        if is_win:\n            existing = conn.execute(\n                \"SELECT id, path, created_at FROM scan_folders WHERE path = ? COLLATE NOCASE\",\n                (normalized,),\n            ).fetchone()","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/unslothai/unsloth/blob/203007d19051dcd2ae33876786d117c99f6b0368/studio/backend/hub/storage/scan_folders.py#L117-L153","documentation":"Validation error from add_scan_folder_with_status: _contains_sensitive_path_component(normalized) matched a credential/configuration component (e.g. .ssh, .aws, .gnupg, or similar config dirs, via the shared sensitive-path denylist). These directories hold secrets and must never become browsable/registered scan roots.","triggerScenarios":"Registering ~/.ssh, ~/.aws, ~/.gnupg, ~/.config, or any path containing such a component anywhere in the path (the check looks at components, not just the tail).","commonSituations":"Users whose entire home is one dotdir-managed tree and try to register ~/.config/models; misunderstanding that hidden directories are fine unless they are on the credential denylist.","solutions":["Move the model files out of the sensitive directory into a neutral one (e.g. ~/models) and register that.","Symlink the model data into a non-sensitive path and register the symlink target's parent (realpath is applied, so the link must resolve outside sensitive dirs)."],"exampleFix":"# before\nadd_scan_folder('/home/alice/.config/models')\n# after\nmkdir -p /home/alice/models && mv /home/alice/.config/models/* /home/alice/models/\nadd_scan_folder('/home/alice/models')","handlingStrategy":"validation","validationCode":"from utils.paths.sensitive import contains_sensitive_path_component\n\ndef scan_folder_is_clean(path: str) -> bool:\n    return not contains_sensitive_path_component(\n        os.path.realpath(os.path.expanduser(path.strip()))\n    )","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep model data out of dot-config/credential directories (.ssh, .aws, .gnupg, ...).","Use the shared contains_sensitive_path_component predicate client-side to pre-screen paths.","Remember the check scans all path components, not just the last one."],"tags":["validation","scan-folders","security","secrets"],"backgroundTag":null,"analyzedSha":"203007d19051dcd2ae33876786d117c99f6b0368","analyzedAt":"2026-08-15T02:48:39.846Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}