diff --git a/.core/reference/embed.go b/.core/reference/embed.go
index 7951543..fd81d28 100644
--- a/.core/reference/embed.go
+++ b/.core/reference/embed.go
@@ -511,7 +511,7 @@ func Extract(fsys fs.FS, targetDir string, data any, opts ...ExtractOptions) Res
 	if err != nil {
 		return Result{err, false}
 	}
-	if err := os.MkdirAll(targetDir, 0755); err != nil {
+	if err := os.MkdirAll(targetDir, 0700); err != nil {
 		return Result{err, false}
 	}
 
@@ -564,7 +564,7 @@ func Extract(fsys fs.FS, targetDir string, data any, opts ...ExtractOptions) Res
 		if err != nil {
 			return Result{err, false}
 		}
-		if err := os.MkdirAll(target, 0755); err != nil {
+		if err := os.MkdirAll(target, 0700); err != nil {
 			return Result{err, false}
 		}
 	}
@@ -592,7 +592,7 @@ func Extract(fsys fs.FS, targetDir string, data any, opts ...ExtractOptions) Res
 			return Result{err, false}
 		}
 
-		f, err := os.Create(targetFile)
+		f, err := os.OpenFile(targetFile, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0600)
 		if err != nil {
 			return Result{err, false}
 		}
@@ -653,11 +653,11 @@ func copyFile(fsys fs.FS, source, target string) error {
 	}
 	defer s.Close()
 
-	if err := os.MkdirAll(filepath.Dir(target), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(target), 0700); err != nil {
 		return err
 	}
 
-	d, err := os.Create(target)
+	d, err := os.OpenFile(target, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0600)
 	if err != nil {
 		return err
 	}
diff --git a/.core/reference/error.go b/.core/reference/error.go
index c56ea7c..99d4942 100644
--- a/.core/reference/error.go
+++ b/.core/reference/error.go
@@ -390,7 +390,7 @@ func (h *ErrorPanic) appendReport(report CrashReport) {
 		Default().Error(Concat("crash report marshal failed: ", err.Error()))
 		return
 	}
-	if err := os.MkdirAll(filepath.Dir(h.filePath), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(h.filePath), 0700); err != nil {
 		Default().Error(Concat("crash report dir failed: ", err.Error()))
 		return
 	}
diff --git a/pkg/lib/workspace/default/.core/reference/embed.go b/pkg/lib/workspace/default/.core/reference/embed.go
index 21009ad..4136713 100644
--- a/pkg/lib/workspace/default/.core/reference/embed.go
+++ b/pkg/lib/workspace/default/.core/reference/embed.go
@@ -515,7 +515,7 @@ func Extract(fsys fs.FS, targetDir string, data any, opts ...ExtractOptions) Res
 	if err != nil {
 		return Result{err, false}
 	}
-	if err := os.MkdirAll(targetDir, 0755); err != nil {
+	if err := os.MkdirAll(targetDir, 0700); err != nil {
 		return Result{err, false}
 	}
 
@@ -568,7 +568,7 @@ func Extract(fsys fs.FS, targetDir string, data any, opts ...ExtractOptions) Res
 		if err != nil {
 			return Result{err, false}
 		}
-		if err := os.MkdirAll(target, 0755); err != nil {
+		if err := os.MkdirAll(target, 0700); err != nil {
 			return Result{err, false}
 		}
 	}
@@ -596,7 +596,7 @@ func Extract(fsys fs.FS, targetDir string, data any, opts ...ExtractOptions) Res
 			return Result{err, false}
 		}
 
-		f, err := os.Create(targetFile)
+		f, err := os.OpenFile(targetFile, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0600)
 		if err != nil {
 			return Result{err, false}
 		}
@@ -657,11 +657,11 @@ func copyFile(fsys fs.FS, source, target string) error {
 	}
 	defer s.Close()
 
-	if err := os.MkdirAll(filepath.Dir(target), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(target), 0700); err != nil {
 		return err
 	}
 
-	d, err := os.Create(target)
+	d, err := os.OpenFile(target, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0600)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/lib/workspace/default/.core/reference/error.go b/pkg/lib/workspace/default/.core/reference/error.go
index 0913757..d186666 100644
--- a/pkg/lib/workspace/default/.core/reference/error.go
+++ b/pkg/lib/workspace/default/.core/reference/error.go
@@ -411,7 +411,7 @@ func (h *ErrorPanic) appendReport(report CrashReport) {
 		Default().Error(Concat("crash report marshal failed: ", err.Error()))
 		return
 	}
-	if err := os.MkdirAll(filepath.Dir(h.filePath), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(h.filePath), 0700); err != nil {
 		Default().Error(Concat("crash report dir failed: ", err.Error()))
 		return
 	}