Oh My Zsh compaudit: missing auto-fix default for world-writable $fpath directories

Background

Oh My Zsh invokes compinit at startup, which runs compaudit to scan every directory in $fpath for group- or other-writable bits. When insecure directories are found, compinit prints a warning and refuses to load completions from them unless the user either runs compaudit | xargs chmod g-w,o-w or sets ZSH_DISABLE_COMPFIX=true in .zshrc before the framework loads.

Constraint

The opt-out variable silences the warning but also disables the protection entirely, allowing completions from world-writable directories to execute without notice. The project has not decided whether to ship a safer default — such as automatically fixing permissions on first run — or to keep the current manual opt-in model. Plugin managers that inject custom paths into $fpath can also introduce world-writable directories on otherwise clean systems, increasing the frequency of false-positive warnings.

Open questions

• Should Oh My Zsh automatically remediate insecure $fpath entries during initial setup, or is the explicit manual step a necessary safety signal?
• Is there a middle ground that preserves the security boundary while reducing friction for users who encounter false positives from package-manager-installed completions?