@@ -68,6 +68,17 @@ Same effect as the CLI flag; useful in containerised deployments.
 
 The file mode is set to `0o600` on POSIX. WAC restricts HTTP access to the pod owner via `<pod>/private/.acl` (the standard private-folder ACL JSS writes anyway).
 
+## Incompatible with `--public`
+
+JSS refuses to provision keys when `--public` mode is on. `--public` tells JSS to skip WAC entirely and grant unauthenticated access to every resource — including `/private/privkey.jsonld`. Combined with `--provision-keys`, that would write a plaintext secret straight to a publicly-readable URL.
+
+The two flags are explicitly incompatible:
+
+- **At server start**: `jss start --single-user --provision-keys --public` throws at server-create time with a clear error. The server doesn't start.
+- **At pod creation over HTTP**: `POST /.pods` with `provisionKeys: true` returns **400 Bad Request** when the server is in `--public` mode.
+
+If you genuinely want both behaviours, you don't actually want both: either pick `--public` (no auth, no secrets on disk) or pick `--provision-keys` (WAC-protected secrets). There's no middle ground that's safe.
+
 ## Threat model and protection
 
 The web user (pod owner) reads the key over HTTP, authenticated against their WebID. WAC checks the request and serves the file:
 
@@ -4,7 +4,7 @@ import { getAllHeaders } from '../ldp/headers.js';
 import { isContainer, getEffectiveUrlPath, getPodName } from '../utils/url.js';
 import { generateProfile, generatePreferences, generateTypeIndex, serialize } from '../webid/profile.js';
 import { generateOwnerAcl, generatePrivateAcl, generateInboxAcl, generatePublicFolderAcl, serializeAcl, relativizeOwnerWebId } from '../wac/parser.js';
-import { provisionOwnerKey } from '../keys/provision.js';
+import { provisionOwnerKey, assertProvisionKeysCompatible } from '../keys/provision.js';
 import { createToken } from '../auth/token.js';
 import { canAcceptInput, toJsonLd, RDF_TYPES } from '../rdf/conneg.js';
 import { emitChange } from '../notifications/events.js';
@@ -306,6 +306,19 @@ export async function handleCreatePod(request, reply) {
     return reply.code(400).send({ error: 'Invalid pod name. Use alphanumeric, dash, or underscore only.' });
   }
 
+  // Refuse provisionKeys + --public: WAC would be bypassed, exposing the
+  // freshly written secret to anyone. Surfaces the contradiction at
+  // request time rather than after a key leak.
+  if (provisionKeys === true && request.config?.public) {
+    return reply.code(400).send({
+      error: 'provisionKeys cannot be used in --public mode',
+      message:
+        '--public bypasses WAC, which would make /private/privkey.jsonld ' +
+        'publicly readable. Use provisionKeys with WAC enforcement (the ' +
+        'default), or drop --public.'
+    });
+  }
+
   const podPath = `/${name}/`;
 
   // Check if pod already exists
 
@@ -119,6 +119,35 @@ export function provisionOwnerKey({ controllerWebId }) {
   };
 }
 
+/**
+ * Refuse to provision keys when WAC is being bypassed.
+ *
+ * `--public` (and `request.config.public`) tells JSS to skip WAC and
+ * grant unauthenticated access to everything. Combined with
+ * `--provision-keys`, it would mean a plaintext secret at
+ * `/private/privkey.jsonld` is readable by anyone over HTTP — the
+ * exact opposite of what the seeded owner-only ACL is supposed to do.
+ *
+ * Throws a clear error so the operator hits the contradiction at
+ * startup (or pod-creation) rather than discovering it by reading
+ * their own server logs after a key leak.
+ *
+ * @param {object} args
+ * @param {boolean} args.provisionKeys
+ * @param {boolean} args.isPublic - jss `--public` mode
+ * @throws {Error} when both flags are true
+ */
+export function assertProvisionKeysCompatible({ provisionKeys, isPublic }) {
+  if (provisionKeys && isPublic) {
+    throw new Error(
+      '--provision-keys cannot be combined with --public. --public bypasses ' +
+      'WAC, which would make /private/privkey.jsonld readable by anyone over ' +
+      'HTTP. Use --provision-keys with WAC enforcement (the default), or drop ' +
+      '--public.'
+    );
+  }
+}
+
 function bytesToHex(bytes) {
   let s = '';
   for (let i = 0; i < bytes.length; i++) {
 
@@ -29,6 +29,7 @@ import { tunnelPlugin } from './tunnel/index.js';
 import { terminalPlugin } from './terminal/index.js';
 import { registerErrorHandler } from './utils/error-handler.js';
 import { seedServerRoot } from './ui/server-root.js';
+import { assertProvisionKeysCompatible } from './keys/provision.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -141,7 +142,15 @@ export function createServer(options = {}) {
   // when a single-user pod is first created. Phase 1 of #437. Off by
   // default: keys-on-disk is a real security tradeoff, opt-in keeps
   // the choice visible to the operator.
+  //
+  // Refuse the --provision-keys + --public combination at server-create
+  // time so the operator hits the contradiction immediately rather than
+  // by reading a leaked key from logs / the public web. See #442 review.
   const provisionKeysEnabled = options.provisionKeys ?? false;
+  assertProvisionKeysCompatible({
+    provisionKeys: provisionKeysEnabled,
+    isPublic: !!options.public
+  });
   const mongoUrl = options.mongoUrl ?? 'mongodb://localhost:27017';
   const mongoDatabase = options.mongoDatabase ?? 'solid';
   // HTTP 402 paid /pay/ routes are OFF by default
 
@@ -152,6 +152,72 @@ describe('POST /.pods — provisionKeys: true (Phase 1 of #437)', () => {
   });
 });
 
+describe('POST /.pods — provisionKeys + --public (footgun guard)', () => {
+  // --public mode bypasses WAC: every resource becomes publicly
+  // readable. Combined with provisionKeys, /private/privkey.jsonld
+  // would be the world's worst secret store. Refuse the combination
+  // at request time with 400 so the operator hits the contradiction
+  // immediately. See #442 review.
+  let server;
+  let baseUrl;
+  let savedDataRoot;
+  const DATA_DIR = './test-data-provision-public';
+
+  before(async () => {
+    savedDataRoot = process.env.DATA_ROOT;
+    await fs.remove(DATA_DIR);
+    await fs.ensureDir(DATA_DIR);
+    const { createServer } = await import('../src/server.js');
+    server = createServer({
+      logger: false,
+      forceCloseConnections: true,
+      root: DATA_DIR,
+      public: true
+    });
+    await server.listen({ port: 0, host: '127.0.0.1' });
+    baseUrl = `http://127.0.0.1:${server.server.address().port}`;
+  });
+  after(async () => {
+    await server.close();
+    await fs.remove(DATA_DIR);
+    if (savedDataRoot === undefined) delete process.env.DATA_ROOT;
+    else process.env.DATA_ROOT = savedDataRoot;
+  });
+
+  it('rejects POST /.pods with provisionKeys: true on a --public server (400)', async () => {
+    const res = await fetch(`${baseUrl}/.pods`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name: 'shouldnotexist', provisionKeys: true })
+    });
+    assert.strictEqual(res.status, 400);
+    const body = await res.json();
+    assert.match(body.message || body.error || '', /public/i,
+      'error must explain why provisionKeys is rejected');
+    // Pod must not have been created.
+    assert.strictEqual(await fs.pathExists(`${DATA_DIR}/shouldnotexist/`), false);
+  });
+
+  it('still allows POST /.pods without provisionKeys on a --public server', async () => {
+    const res = await fetch(`${baseUrl}/.pods`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name: 'publicpod' })
+    });
+    assert.strictEqual(res.status, 201);
+  });
+});
+
+describe('createServer — provisionKeys + --public refused at start', () => {
+  it('throws synchronously when both options are set', async () => {
+    const { createServer } = await import('../src/server.js');
+    assert.throws(
+      () => createServer({ logger: false, provisionKeys: true, public: true }),
+      /cannot be combined with --public/
+    );
+  });
+});
+
 describe('createPodStructure — provisionKeys option (direct call)', () => {
   before(async () => {
     await startTestServer();
 
@@ -10,7 +10,8 @@ import {
   publicKeyMultibase,
   secretKeyMultibase,
   buildOwnerKeyDocument,
-  provisionOwnerKey
+  provisionOwnerKey,
+  assertProvisionKeysCompatible
 } from '../src/keys/provision.js';
 import { decodeFFormSecp256k1 } from '../src/auth/nostr-keys.js';
 
@@ -131,6 +132,36 @@ describe('provisionOwnerKey', () => {
   });
 });
 
+describe('assertProvisionKeysCompatible', () => {
+  // Refuse the provisionKeys + --public combination — public mode
+  // bypasses WAC, which would expose the freshly-written secret on
+  // /private/privkey.jsonld to anyone over HTTP.
+  it('throws when both provisionKeys and isPublic are true', () => {
+    assert.throws(
+      () => assertProvisionKeysCompatible({ provisionKeys: true, isPublic: true }),
+      /cannot be combined with --public/
+    );
+  });
+
+  it('does NOT throw for provisionKeys alone (the supported case)', () => {
+    assert.doesNotThrow(() =>
+      assertProvisionKeysCompatible({ provisionKeys: true, isPublic: false })
+    );
+  });
+
+  it('does NOT throw for --public alone (no secrets being written)', () => {
+    assert.doesNotThrow(() =>
+      assertProvisionKeysCompatible({ provisionKeys: false, isPublic: true })
+    );
+  });
+
+  it('does NOT throw when neither flag is set', () => {
+    assert.doesNotThrow(() =>
+      assertProvisionKeysCompatible({ provisionKeys: false, isPublic: false })
+    );
+  });
+});
+
 function hexToBytes(hex) {
   if (hex.length % 2 !== 0) throw new Error('hex length must be even');
   const out = new Uint8Array(hex.length / 2);