From 29687987b2c30c912f6fa726cd73d0de4f98fa46 Mon Sep 17 00:00:00 2001
From: vgoer <goerblue@gmail.com>
Date: Mon, 24 Aug 2026 09:30:22 +0000
Subject: [PATCH] fix: Restrict JWT key file permissions to 0600

---
 backend/lib/config.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/lib/config.js b/backend/lib/config.js
index 71205013..59cb6598 100644
--- a/backend/lib/config.js
+++ b/backend/lib/config.js
@@ -145,7 +145,7 @@ const generateKeys = () => {
 
 	// Write keys config
 	try {
-		fs.writeFileSync(keysFile, JSON.stringify(keys, null, 2));
+		fs.writeFileSync(keysFile, JSON.stringify(keys, null, 2), { mode: 0o600 });
 	} catch (err) {
 		logger.error(`Could not write JWT key pair to config file: ${keysFile}: ${err.message}`);
 		process.exit(1);