From 6b2d1aafd0711929cb171a4328efac60699cb101 Mon Sep 17 00:00:00 2001
From: Aly Raffauf <aly@raffauflabs.com>
Date: Mon, 6 Apr 2026 20:13:27 -0400
Subject: [PATCH] core/auth: lock down secrets

---
 core/auth/config.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/core/auth/config.py b/core/auth/config.py
index a5101af..ac179a1 100644
--- a/core/auth/config.py
+++ b/core/auth/config.py
@@ -30,5 +30,6 @@ def load_secrets(data_dir: str = ".") -> dict:
         "secret_key": _generate_secret_key(),
         "client_secret_jwk": _generate_client_jwk(),
     }
+    secrets_path.touch(mode=0o600, exist_ok=True)
     secrets_path.write_text(json.dumps(secrets, indent=2))
     return secrets
-- 
2.51.2