Skip to content

Indexing repository unexpectedly indexes C:/Users/{USERNAME} instead of selected repo path (security/privacy risk) #331

Closed

Description

@LeoTheLegion

Summary:
When I index a specific repository in codebase-memory-mcp from VS Code, it appears to index C:/Users/{USERNAME} instead of the selected repository directory.

Why this matters:
This can unintentionally ingest unrelated local files outside the target repository, which is a privacy/security concern.

Environment:

  1. OS: Windows
  2. Install method: PowerShell installer
  3. Client: VS Code (MCP integration)
  4. Repository intended for indexing: specific workspace folder only

Steps to reproduce:

  1. Install codebase-memory-mcp via PowerShell setup on Windows.
  2. Use it in VS Code MCP.
  3. Run index on a specific repository path.
  4. Check resulting indexed project scope/name/content.

Expected behavior:
Only the provided repository directory is indexed.

Actual behavior:
Indexing scope resolves to C:/Users/{USERNAME} (or appears to include that directory), not just the selected repository.

Impact:
Potential accidental indexing of sensitive local data outside the intended repo.

Activity

  1. added
    bugSomething isn't working
    windowsWindows-specific issues
    securitySecurity vulnerabilities, hardening
    on May 30, 2026
  2. DeusData commented on May 31, 2026

    @DeusData
    Owner

    Verified fixed on v0.7.0. Indexing C:/cbmrepo in Windows CI (run) registers the project with root_path: "C:/cbmrepo" (the path I gave) and file nodes src/server.mjs / src/sub/calc.js — not C:/Users/.... The wrong-path scoping is gone (wide-char path handling, #386). Closing — this also removes the privacy concern of ingesting the home directory. Reopen if a specific path still resolves to the home dir on v0.7.0. 🙏

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingsecuritySecurity vulnerabilities, hardeningwindowsWindows-specific issues

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions