[oefrha]

Typical umask is 022 so most things are readable by nginx workers but not writable, they don’t need to be explicitly assigned (e.g. to www-data). If your application generates sensitive data of course you should probably use a 077 umask.

[Jolter]

You could make an argument that bitwarden vaults constitute sensitive information.