app.ini is world readable
After installation, the config file is world readable. I think this to be a bad decision since it contains the mysql db password and the security token of the application.
$ ls -al /opt/gitea/custom/conf/
total 12
drwxr-xr-x 2 gitea gitea 4096 Jan 2 11:40 .
drwxr-xr-x 3 gitea gitea 4096 Jan 2 11:40 ..
-rw-r--r-- 1 gitea gitea 1573 Jan 2 11:40 app.ini