"zsh compinit: insecure directories" warning on every Oh My Zsh startup — fix permissions or accept the framework's skip flag?

Short answer

Correct the permissions on the directories that compaudit reports. The -C flag that Oh My Zsh passes to compinit only silences the message; it does not make the directories safe. Adjust ownership/permissions so that no directory in $fpath is group‑ or world‑writable, then run compinit normally (e.g. compinit -u). If you cannot change a directory (e.g. a Homebrew‑owned path), keep the -C flag but accept the security risk, or move that completion to a user‑owned location.

Why the warning appears

When compinit runs it calls compaudit to scan $fpath for directories that are writable by group or others. Any such directory could be modified by an untrusted user, allowing injection of arbitrary completion code. Oh My Zsh’s compinit -C skips this check, but the underlying risk remains.

Steps to resolve the issue

1. Identify the insecure directories. Run:

   compaudit
   

   This lists every directory that fails the ownership/permission check.
2. Review the list. If you see a Homebrew path such as /opt/homebrew/share/zsh/site-functions, note that Homebrew expects that directory to be writable by your user but not group‑writable.
3. Fix permissions. For each directory that is group‑ or world‑writable, run:

   sudo chown -R $(whoami) <dir>
   chmod -R 755 <dir>
   

   Replace <dir> with the actual path. Do not change ownership to root unless you understand the consequences for package managers.
4. Re‑run compinit. In a fresh shell, execute:

   compinit -u
   

   The -u flag tells compinit to use the cached dump but still perform the audit.
5. Verify the warning is gone. Start a new zsh session and ensure no “insecure directories” message appears.

Handling Homebrew‑owned directories

Homebrew installs completions under /opt/homebrew/share/zsh/site-functions (or /usr/local/share/zsh/site-functions on Intel macOS). These directories are normally owned by your user and set to 755, which is safe. If compaudit flags them, double‑check that the group or others bits are not set to 2 or 4. You can leave them as is if they are already 755; the warning may be a false positive if the directory is a symlink. In that case, you can either remove the symlink from $fpath or create a copy of the directory under $HOME/.oh-my-zsh/custom/completions and add that path to $fpath instead.

Completion caching

zsh automatically writes a compiled dump of all completions to $ZDOTDIR/.zcompdump (by default ~/.zcompdump). There is no Oh My Zsh‑specific cache beyond this. If you want to force a fresh dump after changing permissions, run:

rm -f ~/.zcompdump && compinit -u

This regenerates the file and clears the warning cache.

When to ask for more info

If the steps above do not resolve the warning, please run compaudit and share the exact list of directories it reports. That will help determine whether a non‑standard location is causing the issue.