actually restrict permissions on app secret file