What happened
obsidian-tc's path ACLs only restricted listing, not direct path reads: with undefined readPaths/writePaths every path is allowed, and .obsidian/.git/.trash control directories are blocked only during directory enumeration. An authenticated caller can directly fetch control files such as .obsidian/plugins/*/data.json to obtain plugin API keys and Obsidian Sync passwords stored inside the vault.
Why it matters
Vault-adjacent control files frequently hold the long-lived secrets (sync passwords, plugin/provider keys) that an AI note agent would otherwise not touch. Via this flaw an agent with any valid token can harvest credentials the vault ecosystem itself depends on.
Attack vector
Undefined readPaths/writePaths settings allow all paths; strictReadDefault does not protect direct request paths; .obsidian, .git and .trash control dirs are excluded only during enumeration, not on direct file requests. An authenticated caller reads .obsidian/plugins/*/data.json to steal plugin API keys and Obsidian Sync passwords.
Affected systems
obsidian-tc (The-40-Thieves) < 1.3.1 (path ACL enforcement)
Mitigation
Upgrade to obsidian-tc 1.3.1 (commit 74de320ddea855e1dec47d67beabe88491149dab; PR #73), which denies control directories by default and enforces strictReadDefault on direct requests.