diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..5318123
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2026-10-10 - Update SaveRequest Directory Permissions
+**Vulnerability:** Saved request directories had overly permissive permissions (`0o755`), potentially allowing local users to view saved files including sensitive payloads/headers.
+**Learning:** The application captures arbitrary incoming HTTP requests and allows users to export/save them locally. While `SaveRequest` attempts to redact sensitive headers, other non-redacted data might be sensitive. The directory `SaveDir` where requests are saved was created with `0o755`.
+**Prevention:** Create directories containing sensitive user-data/traffic with `0o700` permissions so only the owner has access.
diff --git a/internal/export/export.go b/internal/export/export.go
index 7b0e25b..95e4043 100644
--- a/internal/export/export.go
+++ b/internal/export/export.go
@@ -89,7 +89,7 @@ func SaveRequest(dir string, ev events.Event, redact bool) (string, error) {
 	if dir == "" {
 		dir = "."
 	}
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	if err := os.MkdirAll(dir, 0o700); err != nil {
 		return "", err
 	}
 	method := cleanName(ev.Request.Method)