diff --git a/internal/cache/helpers.go b/internal/cache/helpers.go
index 543948e..4726d1c 100644
--- a/internal/cache/helpers.go
+++ b/internal/cache/helpers.go
@@ -35,7 +35,10 @@ func downloadToDisk(url, destPath string, c http.Client) error {
 	defer resp.Body.Close()
 
 	// make sure the dir structure exists
-	os.MkdirAll(filepath.Dir(destPath), 0755)
+	err = os.MkdirAll(filepath.Dir(destPath), 0750)
+	if err != nil {
+		return err
+	}
 
 	// use a tmp file for the initial fetch in case it fails
 	tempPath := destPath + ".tmp"
@@ -47,13 +50,19 @@ func downloadToDisk(url, destPath string, c http.Client) error {
 
 	_, err = io.Copy(tmpFile, resp.Body)
 	if err != nil {
-		os.Remove(tempPath)
+		removeErr := os.Remove(tempPath)
+		if removeErr != nil {
+			slog.Warn("failed to remove temp file", "path", tempPath, "err", removeErr)
+		}
 		return err
 	}
 
 	// mv file to final location
 	if err := os.Rename(tempPath, destPath); err != nil {
-		os.Remove(tempPath)
+		removeErr := os.Remove(tempPath)
+		if removeErr != nil {
+			slog.Warn("failed to remove temp file", "path", tempPath, "err", removeErr)
+		}
 		return err
 	}
 	return nil
diff --git a/main.go b/main.go
index f2c655d..5ae5727 100644
--- a/main.go
+++ b/main.go
@@ -6,6 +6,7 @@ import (
 	"log/slog"
 	"net/http"
 	"os"
+	"time"
 
 	"github.com/ewpt3ch/pkgstash/internal/cache"
 )
@@ -65,8 +66,9 @@ func main() {
 	}
 
 	httpServe := &http.Server{
-		Addr:    ":" + srv.cfg.Port,
-		Handler: mux,
+		Addr:              ":" + srv.cfg.Port,
+		Handler:           mux,
+		ReadHeaderTimeout: 5 * time.Second,
 	}
 
 	slog.Info("serving pkgstash", "root", cfg.CacheRoot, "port", cfg.Port)
diff --git a/response_helpers.go b/response_helpers.go
index b3ee259..2cebd2b 100644
--- a/response_helpers.go
+++ b/response_helpers.go
@@ -21,5 +21,5 @@ func respondWithJSON(w http.ResponseWriter, code int, payload any) {
 	}
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(code)
-	w.Write(dat)
+	_, _ = w.Write(dat)
 }