What changed, and why it matters
This commit adds a cleanup instruction so that Sparrow's home folder is automatically deleted when the application exits, but only if the folder is empty. It is a minor housekeeping change and does not appear to be a security fix.
No security action required. Treat as routine cleanup/maintenance.
Security signals we found
No security-relevant change: directory creation permissions remain unchanged (owner-only)
deleteOnExit only removes empty directories, so wallets, config, and logs are not affected
No input validation, parsing, cryptography, or network changes
Evidence from the diff
In Instance.java, after creating the Sparrow home directory with restrictive owner-only permissions, the code now calls File.deleteOnExit(). This registers the directory for deletion at JVM shutdown; Java’s deleteOnExit only removes empty directories. The change prevents an empty application directory from being left behind after first run, but does not alter permissions, access controls, or data handling.
Changed components
src/main/java/com/sparrowwallet/sparrow/instance/Instance.javaInspect captured patch +1 / −0
diff --git a/src/main/java/com/sparrowwallet/sparrow/instance/Instance.java b/src/main/java/com/sparrowwallet/sparrow/instance/Instance.java
index c684252..a5d6556 100644
--- a/src/main/java/com/sparrowwallet/sparrow/instance/Instance.java
+++ b/src/main/java/com/sparrowwallet/sparrow/instance/Instance.java
@@ -197,6 +197,7 @@ public abstract class Instance {
File sparrowHome = Storage.getSparrowHome(true);
if(!sparrowHome.exists()) {
Storage.createOwnerOnlyDirectory(sparrowHome);
+ sparrowHome.deleteOnExit(); //Will only delete on exit if empty
}
return sparrowHome.toPath().resolve(applicationId + ".default");
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.