--- a/log.pl	Mon Jan 05 11:23:32 2015 +0100
+++ b/log.pl	Mon Jan 05 11:31:55 2015 +0100
@@ -129,14 +129,22 @@
     }
 
     if ($opt_initdir) {
+
         my $repo = Logbuch::HG->new(repo => $opt_initdir);
 
         $repo->is_repository()
           and die "$ME: directory already initialized, skipping\n";
 
+        # any repository is likely to contain sensitive data somewhere
+        my $umask = umask 0077
+            or die "$ME: Can't set umask: $!";
+
         $repo->init()
           or die "E: initialization failed\n";
 
+        umask $umask
+            or warn "$ME: Can't restore umask: $!";
+
         $repo->addremove();
         $repo->commit("initial check in");