Function write_atomic_private 

pub fn write_atomic_private(
    path: &Path,
    contents: impl AsRef<[u8]>,
) -> Result<()>

Atomically replace path with contents, creating the replacement file with owner-only permissions (0600) before any contents are written on Unix. For secrets: unlike write-then-chmod there is no window where the bytes exist world-readable.