fix

internal/customerauth/store.go

@@ -174,6 +174,11 @@ func (s *CredentialStore) persistLocked() error {
 		return fmt.Errorf("customerauth: temp file: %w", err)
 	}
 	tmpName := tmp.Name()
+	if err := tmp.Chmod(0644); err != nil {
+		tmp.Close()
+		os.Remove(tmpName)
+		return fmt.Errorf("customerauth: chmod temp: %w", err)
+	}
 	if _, err := tmp.Write(data); err != nil {
 		tmp.Close()
 		os.Remove(tmpName)

pkg/promotions/store.go

@@ -128,6 +128,10 @@ func (s *Store) saveLocked() error {
 	}
 	tmpName := tmp.Name()
 	defer os.Remove(tmpName) // no-op once renamed
+	if err := tmp.Chmod(0644); err != nil {
+		tmp.Close()
+		return err
+	}
 	if _, err := tmp.Write(data); err != nil {
 		tmp.Close()
 		return err