Default cache_dir perms too permissive

### What system are you running Yazi on? Linux X11 ### What terminal are you running Yazi in? Any ### `yazi --debug` output ```Shell Yazi Version : 26.5.6 (Arch Linux 2026-05-10) Debug : false Triple : x86_64-unknown-linux-gnu (linux-x86_64) Rustc : 1.95.0 (59807616 2026-04-14) Backtrace: None Ya Version: 26.5.6 (Arch Linux 2026-05-10) Config Init : /home/jbryan/.config/yazi/init.lua (No such file or directory (os error 2)) Yazi : /home/jbryan/.config/yazi/yazi.toml (No such file or directory (os error 2)) Keymap : /home/jbryan/.config/yazi/keymap.toml (No such file or directory (os error 2)) Theme : /home/jbryan/.config/yazi/theme.toml (No such file or directory (os error 2)) VFS : /home/jbryan/.config/yazi/vfs.toml (No such file or directory (os error 2)) Package : /home/jbryan/.config/yazi/package.toml (No such file or directory (os error 2)) Dark/light flavor: ArcSwapAny("") / ArcSwapAny("") Emulator TERM : Some("tmux-256color") TERM_PROGRAM : Some("tmux") TERM_PROGRAM_VERSION: Some("3.6a") Brand.from_env : Some(Ghostty) Emulator.detect : Emulator { kind: Left(Ghostty), version: "ghostty 1.3.1-arch2", light: false, csi_16t: (8, 15), force_16t: false } Adapter Adapter.matches : Kgp Dimension.available: Dimension { rows: 83, columns: 320, width: 2560, height: 1245 } Desktop XDG_SESSION_TYPE : Some("wayland") WAYLAND_DISPLAY : Some("wayland-0") DISPLAY : None SWAYSOCK : None HYPRLAND_INSTANCE_SIGNATURE: None WAYFIRE_SOCKET : None SSH shared.in_ssh_connection: true WSL WSL: false Variables SHELL : Some("/bin/bash") EDITOR : Some("vim") VISUAL : None YAZI_FILE_ONE : None YAZI_CONFIG_HOME : None YAZI_ZOXIDE_OPTS : None SSH_AUTH_SOCK : Some("/home/jbryan/.ssh/agent/s.KQJ7tWxnXN.sshd.D2VV2wOJXn") FZF_DEFAULT_OPTS : None FZF_DEFAULT_COMMAND: None Text Opener default : Some(OpenerRule { id: Id(3), run: NonEmptyString("${EDITOR:-vi} %s"), block: true, orphan: false, desc: "$EDITOR", for: Unix, spread: true }) block-create: Some(OpenerRule { id: Id(3), run: NonEmptyString("${EDITOR:-vi} %s"), block: true, orphan: false, desc: "$EDITOR", for: Unix, spread: true }) block-rename: Some(OpenerRule { id: Id(3), run: NonEmptyString("${EDITOR:-vi} %s"), block: true, orphan: false, desc: "$EDITOR", for: Unix, spread: true }) Multiplexers TMUX : true tmux version : tmux 3.6a tmux build flags : enable-sixel=Supported ZELLIJ_SESSION_NAME: None Zellij version : No such file or directory (os error 2) Dependencies file : 5.47 ueberzugpp : No such file or directory (os error 2) ffmpeg/ffprobe: 8.1.1 / 8.1.1 pdftoppm : 26.04.0 magick : 7.1.2-21 fzf : 0.72.0 fd/fdfind : No such file or directory (os error 2) / No such file or directory (os error 2) rg : 15.1.0 chafa : 1.18.2 zoxide : No such file or directory (os error 2) 7zz/7z : No such file or directory (os error 2) / 26.01 resvg : 0.47.0 jq : 1.8.1 Clipboard wl-copy/paste: No such file or directory (os error 2) / No such file or directory (os error 2) xclip : 0.13 xsel : No such file or directory (os error 2) Routine `file -bL --mime-type`: text/plain See https://yazi-rs.github.io/docs/plugins/overview#debugging on how to enable logging or debug runtime errors. ``` ### Describe the bug By default, yazi creates a directory in `/tmp` called `yazi-$UID` for cache files. This can include previews of documents. Though the directory is owned by the user that ran yazi, it has world readable permissions (755) allowing any other user of that machine to potentially see the previews. E.g.: ``` jbryan@hydrogen:/tmp $ ls -alh | grep yazi drwxr-xr-x 2 jbryan jbryan 40 May 19 20:30 yazi-1000 -rw-r--r-- 1 jbryan jbryan 13 May 19 20:33 .yazi-debug-1779240838701657.tmp ``` ### Minimal reproducer As a user (e.g. `jbryan`), run yazi and preview any image. As a different user run `yazi /tmp/yazi-$(id -u jbryan)` and browse the first user's images. ### Anything else? While on a single user machine, this may not be a huge issue, in a multi-user environment I would consider this a fairly serious security issue. As mitigation I would suggest either forcing `cache_dir` to have 700 permissions, or move the default location of it to somewhere under the user's home directory. Another option may be to take advantage $XDG_RUNTIME_DIR or $XDG_CACHE_DIR if defined. ### Checklist - [x] I tried the [latest nightly build](https://yazi-rs.github.io/docs/installation#binaries), and the issue is still reproducible - [x] I updated the debug information (`yazi --debug`) input box to the nightly that I tried - [x] I can reproduce it after disabling all custom configs/plugins (`mv ~/.config/yazi ~/.config/yazi-backup`)