feat(security): restrict backup file permissions to owner-only (#40)

Author: kidchenko

.jules/sentinel.md

@@ -1,3 +1,7 @@
+## 2026-02-24 - Insecure Backup Permissions
+**Vulnerability:** Backup archives created by `tools/backup-projects.sh` were readable by all users on the system (0644 default permissions). These archives contain sensitive project files and potentially secrets.
+**Learning:** Shell scripts using `zip` or `tar` often inherit default umask settings, which are typically permissive. Creating backups in shared environments (even multi-user home machines) requires explicit permission handling.
+**Prevention:** Enforce `umask 0077` (or strict `chmod`) when creating sensitive files or archives in shell scripts. Always assume the default environment is insecure.
 # Sentinel Journal
 
 ## 2026-04-15 - Prevent TOCTOU in SSH Key Restoration

tools/backup-projects.sh

@@ -431,6 +431,8 @@ cmd_backup() {
         exclude_args=$(build_exclude_args)
 
         (
+            # Restrict permissions for backup file (owner read/write only)
+            umask 0077
             cd "$HOME" || exit 1
             if [[ "$VERBOSE" == true ]]; then
                 # shellcheck disable=SC2086