What permissions are applied to the credential files?  Do we need to lock these down to avoid leaking them?