diff --git a/src/replica/replica_disk_migrator.cpp b/src/replica/replica_disk_migrator.cpp
index 0cd8a12ccc..355421503a 100644
--- a/src/replica/replica_disk_migrator.cpp
+++ b/src/replica/replica_disk_migrator.cpp
@@ -20,6 +20,7 @@
 #include <boost/algorithm/string/replace.hpp>
 #include <fmt/core.h>
 
+#include "absl/strings/string_view.h"
 #include "common/fs_manager.h"
 #include "common/gpid.h"
 #include "common/replication.codes.h"
@@ -34,7 +35,6 @@
 #include "utils/fail_point.h"
 #include "utils/filesystem.h"
 #include "utils/fmt_logging.h"
-#include "absl/strings/string_view.h"
 #include "utils/thread_access_checker.h"
 
 namespace dsn {
diff --git a/src/replica/replica_stub.cpp b/src/replica/replica_stub.cpp
index e48a2e15ea..46db7c4782 100644
--- a/src/replica/replica_stub.cpp
+++ b/src/replica/replica_stub.cpp
@@ -41,6 +41,7 @@
 #include <set>
 #include <vector>
 
+#include "absl/strings/string_view.h"
 #include "backup/replica_backup_server.h"
 #include "bulk_load/replica_bulk_loader.h"
 #include "common/backup_common.h"
@@ -77,7 +78,6 @@
 #include "utils/process_utils.h"
 #include "utils/rand.h"
 #include "utils/string_conv.h"
-#include "absl/strings/string_view.h"
 #include "utils/strings.h"
 #include "utils/synchronize.h"
 #ifdef DSN_ENABLE_GPERF
diff --git a/src/replica/replication_app_base.cpp b/src/replica/replication_app_base.cpp
index 6085bffc18..e232604f3e 100644
--- a/src/replica/replication_app_base.cpp
+++ b/src/replica/replication_app_base.cpp
@@ -26,13 +26,13 @@
 
 #include <alloca.h>
 #include <rocksdb/env.h>
-#include <rocksdb/slice.h>
 #include <rocksdb/status.h>
 #include <fstream>
 #include <memory>
 #include <utility>
 #include <vector>
 
+#include "absl/strings/string_view.h"
 #include "common/bulk_load_common.h"
 #include "common/duplication_common.h"
 #include "common/replica_envs.h"
@@ -51,14 +51,10 @@
 #include "utils/binary_reader.h"
 #include "utils/binary_writer.h"
 #include "utils/blob.h"
-#include "utils/defer.h"
-#include "utils/env.h"
 #include "utils/factory_store.h"
 #include "utils/fail_point.h"
-#include "utils/filesystem.h"
 #include "utils/fmt_logging.h"
 #include "utils/latency_tracer.h"
-#include "absl/strings/string_view.h"
 
 namespace dsn {
 
@@ -66,29 +62,6 @@ namespace replication {
 
 const std::string replica_init_info::kInitInfo = ".init-info";
 
-namespace {
-error_code write_blob_to_file(const std::string &fname, const blob &data)
-{
-    // TODO(yingchun): consider not encrypt the meta files.
-    std::string tmp_fname = fname + ".tmp";
-    auto cleanup = defer([tmp_fname]() { utils::filesystem::remove_path(tmp_fname); });
-    auto s =
-        rocksdb::WriteStringToFile(dsn::utils::PegasusEnv(dsn::utils::FileDataType::kSensitive),
-                                   rocksdb::Slice(data.data(), data.length()),
-                                   tmp_fname,
-                                   /* should_sync */ true);
-    LOG_AND_RETURN_NOT_TRUE(
-        ERROR, s.ok(), ERR_FILE_OPERATION_FAILED, "write file {} failed", tmp_fname);
-    LOG_AND_RETURN_NOT_TRUE(ERROR,
-                            utils::filesystem::rename_path(tmp_fname, fname),
-                            ERR_FILE_OPERATION_FAILED,
-                            "move file from {} to {} failed",
-                            tmp_fname,
-                            fname);
-    return ERR_OK;
-}
-} // namespace
-
 error_code replica_init_info::load(const std::string &dir)
 {
     std::string info_path = utils::filesystem::path_combine(dir, kInitInfo);
@@ -136,7 +109,9 @@ error_code replica_init_info::load_json(const std::string &fname)
 
 error_code replica_init_info::store_json(const std::string &fname)
 {
-    return write_blob_to_file(fname, json::json_forwarder<replica_init_info>::encode(*this));
+    return write_blob_to_file(fname,
+                              json::json_forwarder<replica_init_info>::encode(*this),
+                              dsn::utils::FileDataType::kSensitive);
 }
 
 std::string replica_init_info::to_string()
@@ -184,7 +159,7 @@ error_code replica_app_info::store(const std::string &fname)
         marshall(writer, tmp, DSF_THRIFT_JSON);
     }
 
-    return write_blob_to_file(fname, writer.get_buffer());
+    return write_blob_to_file(fname, writer.get_buffer(), dsn::utils::FileDataType::kSensitive);
 }
 
 /*static*/
diff --git a/src/replica/replication_app_base.h b/src/replica/replication_app_base.h
index 5ae162a1bb..327e0a2449 100644
--- a/src/replica/replication_app_base.h
+++ b/src/replica/replication_app_base.h
@@ -26,6 +26,9 @@
 
 #pragma once
 
+#include <rocksdb/env.h>
+#include <rocksdb/slice.h>
+#include <rocksdb/status.h>
 #include <stdint.h>
 #include <string.h>
 #include <atomic>
@@ -38,7 +41,11 @@
 #include "metadata_types.h"
 #include "replica/replica_base.h"
 #include "replica_admin_types.h"
+#include "utils/defer.h"
+#include "utils/env.h"
 #include "utils/error_code.h"
+#include "utils/filesystem.h"
+#include "utils/fmt_logging.h"
 #include "utils/fmt_utils.h"
 #include "utils/ports.h"
 
@@ -53,6 +60,30 @@ class learn_state;
 class mutation;
 class replica;
 
+namespace {
+template <class T>
+error_code write_blob_to_file(const std::string &fname,
+                              const T &data,
+                              const dsn::utils::FileDataType &fileDataType)
+{
+    std::string tmp_fname = fname + ".tmp";
+    auto cleanup = defer([tmp_fname]() { utils::filesystem::remove_path(tmp_fname); });
+    auto s = rocksdb::WriteStringToFile(dsn::utils::PegasusEnv(fileDataType),
+                                        rocksdb::Slice(data.data(), data.length()),
+                                        tmp_fname,
+                                        /* should_sync */ true);
+    LOG_AND_RETURN_NOT_TRUE(
+        ERROR, s.ok(), ERR_FILE_OPERATION_FAILED, "write file {} failed", tmp_fname);
+    LOG_AND_RETURN_NOT_TRUE(ERROR,
+                            utils::filesystem::rename_path(tmp_fname, fname),
+                            ERR_FILE_OPERATION_FAILED,
+                            "move file from {} to {} failed",
+                            tmp_fname,
+                            fname);
+    return ERR_OK;
+}
+} // namespace
+
 class replica_init_info
 {
 public: