Skip to content

Indexing repository unexpectedly indexes C:/Users/{USERNAME} instead of selected repo path (security/privacy risk) #331

@LeoTheLegion

Description

@LeoTheLegion

Summary:
When I index a specific repository in codebase-memory-mcp from VS Code, it appears to index C:/Users/{USERNAME} instead of the selected repository directory.

Why this matters:
This can unintentionally ingest unrelated local files outside the target repository, which is a privacy/security concern.

Environment:

  1. OS: Windows
  2. Install method: PowerShell installer
  3. Client: VS Code (MCP integration)
  4. Repository intended for indexing: specific workspace folder only

Steps to reproduce:

  1. Install codebase-memory-mcp via PowerShell setup on Windows.
  2. Use it in VS Code MCP.
  3. Run index on a specific repository path.
  4. Check resulting indexed project scope/name/content.

Expected behavior:
Only the provided repository directory is indexed.

Actual behavior:
Indexing scope resolves to C:/Users/{USERNAME} (or appears to include that directory), not just the selected repository.

Impact:
Potential accidental indexing of sensitive local data outside the intended repo.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingsecuritySecurity vulnerabilities, hardeningwindowsWindows-specific issues

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions