diff --git a/engine/compiler/shell/shell.go b/engine/compiler/shell/shell.go
index 2f6aa26..aad15ab 100644
--- a/engine/compiler/shell/shell.go
+++ b/engine/compiler/shell/shell.go
@@ -36,6 +36,7 @@ func Script(commands []string) string {
 const optionScript = `
 if [ ! -z "${DRONE_NETRC_FILE}" ]; then
 	echo $DRONE_NETRC_FILE > $HOME/.netrc
+	chmod 600 $HOME/.netrc
 fi
 
 unset DRONE_SCRIPT