Obsidian Vault path is unsafe: selected Vault path is sensit

Error message

Obsidian Vault path is unsafe: selected Vault path is sensitive

What it means

A wrapped variant of errObsidianVaultUnsafePath (line 576-577): returned when util.IsSensitivePath(abs) flags the resolved Vault root as a sensitive/system path. IsSensitivePath blocks OS-critical directories (e.g. /, /etc, /usr, Windows system directories) to prevent accidental or malicious reads of system files during the recursive Vault scan. The error wraps the unsafe sentinel with ': selected Vault path is sensitive'.

Source

Thrown at kernel/model/import_obsidian.go:577

	if strings.TrimSpace(localPath) == "" {
		return "", fmt.Errorf("%w: path is empty", errObsidianVaultUnreadable)
	}
	abs, err := filepath.Abs(filepath.Clean(localPath))
	if err != nil {
		return "", fmt.Errorf("%w: normalize Vault path: %v", errObsidianVaultUnreadable, err)
	}
	info, err := os.Lstat(abs)
	if err != nil {
		return "", fmt.Errorf("%w: read Vault root: %v", errObsidianVaultUnreadable, err)
	}
	if !info.IsDir() {
		return "", errObsidianVaultNotDirectory
	}
	if info.Mode()&os.ModeSymlink != 0 || isObsidianResolvedLink(abs) {
		return "", fmt.Errorf("%w: Vault root is a symbolic link or reparse point", errObsidianVaultUnsafePath)
	}
	if util.IsSensitivePath(abs) {
		return "", fmt.Errorf("%w: selected Vault path is sensitive", errObsidianVaultUnsafePath)
	}
	workspace, _ := filepath.Abs(filepath.Clean(util.WorkspaceDir))
	if sameObsidianPath(abs, workspace) || gulu.File.IsSubPath(workspace, abs) || gulu.File.IsSubPath(abs, workspace) {
		return "", fmt.Errorf("%w: Vault root and SiYuan workspace contain each other", errObsidianVaultUnsafePath)
	}
	configPath := filepath.Join(abs, ".obsidian")
	configInfo, statErr := os.Lstat(configPath)
	if statErr != nil {
		if os.IsNotExist(statErr) {
			return "", errObsidianVaultConfigMissing
		}
		return "", fmt.Errorf("%w: read Vault config directory: %v", errObsidianVaultUnreadable, statErr)
	}
	if !configInfo.IsDir() || configInfo.Mode()&os.ModeSymlink != 0 || isObsidianResolvedLink(configPath) {
		return "", errObsidianVaultConfigMissing
	}
	return abs, nil
}

View on GitHub (pinned to 251596fc0d)

Solutions

Select a user-data directory for the Vault (e.g. under the home directory), not a system root or OS folder.
If the Vault legitimately resides under a flagged path, move or copy it to a neutral location like ~/Vaults.
Check IsSensitivePath's blocklist to understand which ancestor path triggered the flag and avoid it.

Example fix

// before
localPath := "/" // or C:\
// -> "Obsidian Vault path is unsafe: selected Vault path is sensitive"

// after
localPath := "/home/user/ObsidianVaults/MyVault"

Defensive patterns

Strategy: validation

Validate before calling

// Reject sensitive system paths before calling the API
if util.IsSensitivePath(abs) {
    return errors.New("selected path is a sensitive system directory; choose a user-data folder")
}

Try / catch

if _, err := model.StartObsidianVaultAnalysis(localPath); err != nil {
    if errors.Is(err, errObsidianVaultUnsafePath) && strings.Contains(err.Error(), "sensitive") {
        return errors.New("the selected path is a sensitive system directory; move the Vault to a user folder")
    }
}

Prevention

Place Vaults under the user home directory, never at filesystem roots or system folders.
Run a sensitivity check on the client before submitting the path.

When it happens

Trigger: POST /api/import/startObsidianVaultAnalysis with a localPath resolving to a path IsSensitivePath considers dangerous — a filesystem root, a system directory, or a path on IsSensitivePath's blocklist.

Common situations: User accidentally selects the filesystem root (/) or a system directory as the Vault; a path like /etc or C:\Windows is chosen; the Vault happens to live inside a directory IsSensitivePath flags.

Related errors

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/bfa6f13e3553e944. Report an issue: GitHub.