diff --git a/internal/driver/tempfile.go b/internal/driver/tempfile.go
index b6c8776ff8..ed48368bf8 100644
--- a/internal/driver/tempfile.go
+++ b/internal/driver/tempfile.go
@@ -24,7 +24,7 @@ import (
 // newTempFile returns a new output file in dir with the provided prefix and suffix.
 func newTempFile(dir, prefix, suffix string) (*os.File, error) {
 	for index := 1; index < 10000; index++ {
-		switch f, err := os.OpenFile(filepath.Join(dir, fmt.Sprintf("%s%03d%s", prefix, index, suffix)), os.O_RDWR|os.O_CREATE|os.O_EXCL, 0666); {
+		switch f, err := os.OpenFile(filepath.Join(dir, fmt.Sprintf("%s%03d%s", prefix, index, suffix)), os.O_RDWR|os.O_CREATE|os.O_EXCL, 0600); {
 		case err == nil:
 			return f, nil
 		case !os.IsExist(err):
diff --git a/internal/driver/tempfile_test.go b/internal/driver/tempfile_test.go
index 70043534c1..1f38e72ac8 100644
--- a/internal/driver/tempfile_test.go
+++ b/internal/driver/tempfile_test.go
@@ -2,6 +2,7 @@ package driver
 
 import (
 	"os"
+	"runtime"
 	"sync"
 	"testing"
 )
@@ -45,6 +46,13 @@ func TestNewTempFile(t *testing.T) {
 			break
 		}
 		names[name] = true
+		// Temp files can hold profile data, so they must not be accessible
+		// by group or other users.
+		if fi, err := os.Stat(name); err != nil {
+			t.Errorf("Stat(%s): got error %v, want no error", name, err)
+		} else if perm := fi.Mode().Perm(); runtime.GOOS != "windows" && perm&0077 != 0 {
+			t.Errorf("temp file %s has mode %#o, want no group/other access", name, perm)
+		}
 	}
 	if err := cleanupTempFiles(); err != nil {
 		t.Errorf("cleanupTempFiles(): got error %v, want no error", err)