const LOOSE_MASK: u32 = 0o077;
Bits that must not be set on a file holding a secret: group and other, every permission. 0600 is the only mode that passes.
0600