Exporting a snapshot needs a lower role than renaming one #8574

forge/lib/permissions.js has the snapshot permissions sitting like this:

snapshot:full    Member   read     view full snapshot details excluding credentials
snapshot:export  Member   write    export a snapshot including credentials
snapshot:edit    Owner    write
snapshot:delete  Owner    write
snapshot:import  Owner    write

So a Member can export, and an export hands back every flow credential and every hidden env var value, re-encrypted with a secret the caller chooses and therefore fully readable to them. Confirmed locally: exported a snapshot with a hidden env var and decrypted the value straight back out with the secret I passed in.

That same Member can't rename the snapshot, or delete it, or import one.

Might be deliberate, export has been Member for a long time and it's the natural pair to snapshot:full, which is also Member. But snapshot:full deliberately excludes credentials and blanks hidden values, and export deliberately includes them, so they don't feel like the same sensitivity. Worth a second opinion on whether export belongs at Owner alongside the other writes.