commonware-flood creates world-readable config files with private keys

[dnkolegov-ar]

To make sure that the file creation code snippet will not be used in production-ready code.

This is an extremely popular bug when developers create a file with a default mask and write confidential data there.

[patrick-ogrady]

We explicitly communicate that examples should be considered insecure (intentionally preferring quick setup over robust/secure setup to make it easier to get started):

Examples may include insecure code (i.e. deriving keypairs from an integer arguments) to make them easier to run. Examples are not intended to be used directly in production.

We (purposely) follow the pattern you've called out in a number of other places:

• bridge
• alto
• deployer

We expect to provide a guide on what a production setup looks like (at the minimum will include a STRONG WARNING to only ever derive a shared secret via DKG and to store secrets carefully/outside of configs).

I'll leave this issue open as a reminder of this planned work but don't plan to make any changes to this at the moment.