diff --git a/deno.json b/deno.json
index 863d35c..40a1547 100644
--- a/deno.json
+++ b/deno.json
@@ -1,9 +1,9 @@
 {
   "tasks": {
-    "dev": "deno run --allow-all --watch server.ts",
-    "server": "deno run --allow-all server.ts",
-    "compile": "deno compile --allow-all --include ./assets/ --exclude ./tests/ --output ./build/substr_x86_64-unknown-linux-gnu server.ts",
-    "test": "DENO_ENV=test deno test --allow-read --allow-env"
+    "dev": "deno run -P --watch server.ts",
+    "server": "deno run -P server.ts",
+    "compile": "deno compile -P --include ./assets/ --exclude ./tests/ --output ./build/substr_x86_64-unknown-linux-gnu server.ts",
+    "test": "DENO_ENV=test deno test -P=test"
   },
   "imports": {
     "@deno/gfm": "jsr:@deno/gfm@^0.10.0",
@@ -22,5 +22,32 @@
       "assets/css/prism.css",
       "tests/fixtures/"
     ]
+  },
+  "permissions": {
+    "default": {
+      "read": [
+        ".env",
+        ".env.test",
+        "users.yaml",
+        "users.yaml.test",
+        "/etc/substr/users.yaml",
+        "/etc/substr/users.yaml.test",
+        "/tmp/substr/",
+        "assets/"
+      ],
+      "write": ["/tmp/substr/"],
+      "run": ["which", "magick", "convert"],
+      "env": true,
+      "net": true
+    },
+    "test": {
+      "read": [
+        "tests/",
+        ".env.test",
+        "users.yaml.test",
+        "/etc/substr/users.yaml.test"
+      ],
+      "env": true
+    }
   }
 }