How your store's sensitive files are protected

A Magento store keeps a couple of files on disk that hold secrets — your database settings, your store's encryption key, and (if you've added them) your Adobe Commerce keys. On our managed hosting these files are locked down for you automatically, so they can't be read by anything that shouldn't see them.

The two files and their permissions

File	What it holds	Permission
app/etc/env.php	Database settings and your store's encryption key	640
auth.json	Your Adobe Commerce (Marketplace) keys, if you've added them	640

What the numbers mean — both files are 640: readable and writable by your store's own system account, readable (not writable) by the web server that serves your store, and not readable by anyone or anything else, and never public. The web server needs to read both at runtime to run your store — Magento checks your store's version and settings on every admin request — but only the store account can change them, which is exactly what the store needs and nothing more.

Neither file is ever world-readable, and neither is ever served over the web.

You don't have to do anything

These permissions are applied when your store is set up and re-applied automatically whenever your store is restored or upgraded — so they stay correct over the life of your store without any action from you. If you add your own Adobe Commerce keys later, the same protection is applied to auth.json the moment they're saved.

Related

• Your encryption key when you export or import store data — what the encryption key in env.php is and why it matters when you move your data.