PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties. afterPropertiesSet() creates this directory and file with File.mkdirs() and File.createNewFile(), and saveMetadata() writes to it via a plain FileOutputStream, without ever restricting permissions. On a typical POSIX host the directory and file therefore inherit the process umask (commonly 0755 and 0644), leaving both world-readable in a java.io.tmpdir location shared by every local user. Any other local user or process can read the metadata store's contents, which may include sensitive state such as processed message keys, offsets, or idempotency markers used by the application.