## Highlights

## Security

- Only root can now read the tunnel database and WireGuard configuration, which hold the server's keys. Existing installs are tightened when the service starts. Thanks to dritzps for reporting this.

- Publishing to the Start9 apt repository now refuses to sign any package the repository's existing signed index does not list. Thanks to dritzps for reporting this.