diff --git a/scripts/install b/scripts/install
index 0cabf53..bf26f2a 100755
--- a/scripts/install
+++ b/scripts/install
@@ -30,6 +30,7 @@ ynh_setup_source --dest_dir="$install_dir"
 # permission by default ... however, you may need to recursively reapply
 # ownership to all files such as after the ynh_setup_source step
 chown -R $app:www-data "$install_dir"
+chmod o-rwx "$install_dir" -R
 
 #=================================================
 # SYSTEM CONFIGURATION
diff --git a/scripts/upgrade b/scripts/upgrade
index 70f2526..d353076 100755
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -45,6 +45,7 @@ fi
 # permission by default ... however, you may need to recursively reapply
 # ownership to all files such as after the ynh_setup_source step
 chown -R $app:www-data "$install_dir"
+chmod o-rwx "$install_dir" -R
 
 # Disable maintenance mode
 ynh_write_var_in_file --file="$install_dir/.env" --key="MAINTENANCE_MODE" --value="false"
diff --git a/tests.toml b/tests.toml
new file mode 100644
index 0000000..fc1271e
--- /dev/null
+++ b/tests.toml
@@ -0,0 +1,56 @@
+test_format = 1.0
+
+[default]
+
+    # ------------
+    # Tests to run
+    # ------------
+
+    # NB: the tests to run are automatically deduced by the CI script according to the
+    # content of the app's manifest. The declarations below allow to customize which
+    # tests are ran, possibly add special test suite to test special args, or
+    # declare which commits to test upgrade from.
+    #
+    # You can also decide (though this is discouraged!) to ban/ignore some tests,
+
+    exclude = ["install.private", "install.multi", "install.subdir"]  
+    # The test IDs to be used in only/exclude statements are: install.root, install.subdir, install.nourl, install.multi, backup_restore, upgrade, upgrade.someCommitId change_url
+    # NB: you should NOT need this except if you really have a good reason...
+
+    # For special usecases, sometimes you need to setup other things on the machine
+    # prior to installing the app (such as installing another app)
+    # (Remove this key entirely if not needed)
+    # preinstall = """
+    # sudo yunohost app install foobar
+    # sudo yunohost user list
+    # """
+
+    # -------------------------------
+    # Default args to use for install
+    # -------------------------------
+    
+    # By default, the CI will automagically fill the 'standard' args
+    # such as domain, path, admin, is_public and password with relevant values
+    # and also install args with a "default" provided in the manifest..
+    # It should only make sense to declare custom args here for args with no default values
+
+    # args.language = "fr_FR"    # NB: you should NOT need those lines unless for custom questions with no obvious/default value
+    # args.multisite = 0
+
+    # -------------------------------
+    # Commits to test upgrade from
+    # -------------------------------
+
+    # test_upgrade_from.00a1a6e7.name = "Upgrade from 5.4"
+    # test_upgrade_from.00a1a6e7.args.foo = "bar"
+
+
+# This is an additional test suite
+# [some_additional_testsuite]
+
+    # On additional tests suites, you can decide to run only specific tests
+
+    # only = ["install.subdir"]    
+
+    # args.language = "en_GB"
+    # args.multisite = 1