These permissions seem a bit wide open, no?