Make sure secrets file is not other-accessible, and owned by root if the