Only now I look at the docs, I see directories are created in mode 777 (world writable) by default. I'm not sure what files might be fetched, but I guess we might want something like 775.