diff --git a/commands/api_test.go b/commands/api_test.go
index <HASH>..<HASH> 100644
--- a/commands/api_test.go
+++ b/commands/api_test.go
@@ -198,7 +198,7 @@ var _ = Describe("API", func() {
 			session := runCommand("api", httpServer.URL())
 			Eventually(session).Should(Exit(0))
 			Eventually(session).Should(Say("Warning: Insecure HTTP API detected. Data sent to this API could be intercepted" +
-				" in transit by third parties. Secure HTTPS API endpoints are recommended."))
+					" in transit by third parties. Secure HTTPS API endpoints are recommended."))
 		})
 	})
 })
diff --git a/config/config.go b/config/config.go
index <HASH>..<HASH> 100644
--- a/config/config.go
+++ b/config/config.go
@@ -6,6 +6,7 @@ import (
 	"os"
 	"path"
 	"runtime"
+	"syscall"
 )
 
 const AuthClient = "credhub"
@@ -51,7 +52,9 @@ func WriteConfig(c Config) {
 	os.MkdirAll(configDir(), 0755)
 
 	data, _ := json.Marshal(c)
-	ioutil.WriteFile(ConfigPath(), data, 0600)
+	configPath := ConfigPath()
+	ioutil.WriteFile(configPath, data, 0600)
+	syscall.Chmod(configPath, 0600)
 }
 
 func RemoveConfig() {
Use syscall to change file permissions

[#<I>] Windows CLI config file should be hidden and only readable by the local user