diff --git a/scripts/entrypoint.sh b/scripts/entrypoint.sh
index 109fbc7..7e70b2d 100755
--- a/scripts/entrypoint.sh
+++ b/scripts/entrypoint.sh
@@ -19,8 +19,53 @@ else
     echo "User $user already exists"
 fi
 
-mkdir -p /home/$user/app
-mkdir -p /home/$user/logs/{nginx,nodejs}
+# ---- root never follows customer symlinks under /home/$user ----
+# /home/$user is the customer's bind mount: they can plant symlinks in it, and
+# root touching/chowning/writing through one (e.g. logs/nginx -> /etc) gives
+# them that target. logs/ is WHP-owned and nginx opens files in it as root, so
+# symlinks there are removed and logged; everything under /home/$user is created/written AS THE CUSTOMER.
+as_user() {
+  if command -v setpriv >/dev/null 2>&1; then
+    setpriv --reuid="$uid" --regid="$uid" --init-groups -- "$@"
+  else
+    runuser -u "$user" -- "$@"
+  fi
+}
+# Fail closed: refusing to start only hurts the customer who planted the path,
+# which is preferred to root following it.
+die() {
+  echo "entrypoint: FATAL: $* - refusing to start" >&2
+  exit 1
+}
+# Unlink AS THE CUSTOMER: rm on the final component never touches the link
+# target, and if a parent dir is swapped for a symlink mid-way the customer can
+# only delete what they already could. Still a symlink afterwards -> refuse to
+# start (fail closed).
+drop_symlink() {
+  if [ -L "$1" ]; then
+    echo "entrypoint: SECURITY: $1 was a symlink to '$(readlink "$1")' - removing" >&2
+    as_user rm -f -- "$1"
+    [ -L "$1" ] && die "could not remove symlink $1"
+  fi
+  return 0
+}
+if [ -L /home/$user ] || [ ! -d /home/$user ]; then
+  die "/home/$user is not a real directory"
+fi
+chown -h $user:$user /home/$user
+# app/ may legitimately be a symlink (releases/current deploys): it is left
+# alone, and every root-side operation on it below runs as the customer.
+drop_symlink /home/$user/logs
+if [ -d /home/$user/logs ]; then
+  # nginx opens its logs here as root. As the customer: find without -L never
+  # follows symlinks, -delete unlinks the link itself, and a raced parent swap
+  # can only reach what the customer could already delete. Re-checked
+  # fail-closed immediately before nginx starts.
+  as_user find /home/$user/logs -xdev -type l \
+    -printf 'entrypoint: SECURITY: %p was a symlink to %l - removed\n' -delete >&2 || true
+fi
+
+as_user mkdir -p /home/$user/app /home/$user/logs/nginx /home/$user/logs/nodejs
 
 # Link log directories
 rm -rf /var/log/nginx
@@ -30,9 +75,31 @@ ln -s /home/$user/logs/nodejs /var/log/nodejs
 # Configure nginx for reverse proxy
 /scripts/create-nginx-config.sh
 
-# Set ownership and permissions
+# Set ownership and permissions. GNU chown -R defaults to -P: symlinks are
+# lchown()ed, never followed.
 chown -R $user:$user /home/$user
-chmod -R 755 /home/$user
+# Do NOT `chmod -R 755` here. /home/$user is the customer's bind-mounted
+# directory; a recursive 755 on every start made every file (.env, app
+# secrets) world-readable AND executable, and reverted any tighter
+# permissions the customer had set. nginx workers run as `nginx` (not the
+# customer) and serve /static/ straight from /home/$user/app/public/, so they
+# only need to traverse directories. Normalise that and nothing else: open the
+# home dir itself (adduser -m creates it 0700 when it does not exist yet), and
+# add o+x to directories that lack it. Regular files are never touched.
+# The find runs AS THE CUSTOMER: `-type d` without -L skips symlinks, and if a
+# dir is swapped for a symlink before chmod runs, the customer can only reach
+# what they already own.
+chmod 755 /home/$user
+as_user find /home/$user -type d ! -perm -o=x -exec chmod o+x {} + 2>/dev/null || true
+
+# nginx opens its logs under /home/$user/logs as root: last fail-closed check
+# immediately before it starts. logs/, logs/nginx, logs/nodejs must be real
+# dirs and nothing under logs/ may be other than a regular file or directory.
+for d in /home/$user/logs /home/$user/logs/nginx /home/$user/logs/nodejs; do
+  [ -d "$d" ] && [ ! -L "$d" ] || die "$d is not a real directory"
+done
+bad=$(find /home/$user/logs -xdev ! -type f ! -type d -print -quit 2>&1)
+[ -z "$bad" ] || die "unsafe entry under /home/$user/logs: $bad"
 
 # Start nginx
 nginx
@@ -59,15 +126,13 @@ fi
 # Create app directory if it doesn't exist
 if [ ! -d /home/$user/app ]; then
   echo "Creating app directory at /home/$user/app"
-  mkdir -p /home/$user/app
-  chown -R $user:$user /home/$user/app
+  as_user mkdir -p /home/$user/app
 fi
 
 # If app directory is empty, copy the simple-website example
 if [ -z "$(ls -A /home/$user/app)" ]; then
   echo "App directory is empty, copying simple-website example..."
-  cp -r /examples/simple-website/* /home/$user/app/
-  chown -R $user:$user /home/$user/app
+  as_user cp -r /examples/simple-website/. /home/$user/app/
   echo "Copied simple-website example to provide a working application"
 fi
 
@@ -85,8 +150,9 @@ su -c "npm install" $user
 # Check if ecosystem.config.js exists, if not generate it
 if [ ! -f /home/$user/app/ecosystem.config.js ]; then
   echo "No ecosystem.config.js found, generating from package.json..."
-  /scripts/generate-ecosystem-config.sh "$user" "/home/$user/app"
-  chown $user:$user /home/$user/app/ecosystem.config.js
+  # As the customer: it reads their package.json and writes into their app dir.
+  drop_symlink /home/$user/app/ecosystem.config.js
+  as_user /scripts/generate-ecosystem-config.sh "$user" "/home/$user/app"
 fi
 
 # Mirror logs to docker logs in the background.