This change replaces insecure file writes followed by `os.chmod` with `utils.atomic_write.atomic_write` in `portable_backup.py` and `manager.py`. The `atomic_write` function uses `tempfile.mkstemp` to ensure files are created with restrictive permissions (0o600) from the start, eliminating the race condition where sensitive data could be briefly world-readable.
- Updated `export_backup` in `portable_backup.py` to use `atomic_write` for both the JSON backup and its encrypted counterpart.
- Updated `handle_export_totp_codes` in `manager.py` to use `atomic_write` for TOTP exports.
- Added `test_atomic_write_perms.py` to verify permissions behavior (though it relies on system-specific `mkstemp` behavior).
- Verified fix by running existing tests `test_portable_backup.py`, `test_export_totp_codes.py`, and `test_atomic_write.py`.
Co-authored-by: PR0M3TH3AN <[email protected]>
