I noticed that the default sqlite3 database file (/var/lib/soju/main.db) by default is globally readable (644). This surprised me as it contains sensitive data such as clear text nickserv passwords. Shouldn't this be locked down to the soju user (600)?
Indeed, this is an oversight.