restrict permissions on app secret file