@@ -1,6 +1,18 @@
 Upcoming
 ========
 
+Bug fixes:
+----------
+* Create the history, log and config files readable by their owner only
+  (0600). They were left to the process umask, which is 0644 or 0664 on a
+  typical desktop, while the history records every statement typed,
+  ``alter role ... password`` included, the log carries the same at DEBUG
+  level and the config can hold passwords in ``[alias_dsn]``. psql keeps its
+  history at 0600 and libpq requires it for ``.pgpass``. An existing history
+  or log with wider permissions is tightened on the next run; device nodes
+  such as ``/dev/null``, FIFOs and files owned by someone else are left
+  alone.
+
 
 4.7.1 (2026-09-20)
 ==================
 
@@ -1,6 +1,7 @@
 import shutil
 import os
 import platform
+import stat
 from os.path import expanduser, exists, dirname
 import re
 from typing import TextIO
@@ -34,6 +35,44 @@ def ensure_dir_exists(path):
     os.makedirs(parent_dir, exist_ok=True)
 
 
+def ensure_private_file(path):
+    """Create ``path`` if missing and keep it readable by its owner only.
+
+    The history records every statement typed, ``alter role ... password``
+    included, the log can carry the same at DEBUG level and the config can
+    hold passwords in ``[alias_dsn]`` entries. psql keeps its history at 0600
+    and libpq refuses a ``.pgpass`` that is not, so pgcli does the same
+    instead of leaving these to the process umask.
+
+    Only a regular file owned by the current user is touched: a history_file
+    pointing at ``/dev/null`` (the usual way to record nothing), a FIFO or a
+    directory is left alone, and any OSError (read-only media, exotic
+    filesystems) is ignored so a permissions problem never keeps pgcli from
+    starting.
+    """
+    path = expanduser(path)
+    # O_NONBLOCK: opening a FIFO with no reader must fail, not hang pgcli.
+    flags = os.O_WRONLY | os.O_CREAT | os.O_APPEND | getattr(os, "O_NONBLOCK", 0) | getattr(os, "O_NOCTTY", 0)
+    try:
+        fd = os.open(path, flags, 0o600)
+    except OSError:
+        return
+    try:
+        st = os.fstat(fd)
+        owner = getattr(os, "getuid", lambda: st.st_uid)()
+        if stat.S_ISREG(st.st_mode) and st.st_uid == owner and stat.S_IMODE(st.st_mode) & 0o077:
+            # fchmod on the descriptor we already hold: no path lookup
+            # between the stat and the chmod.
+            if hasattr(os, "fchmod"):
+                os.fchmod(fd, 0o600)
+            else:
+                os.chmod(path, 0o600)
+    except OSError:
+        pass
+    finally:
+        os.close(fd)
+
+
 def write_default_config(source, destination, overwrite=False):
     destination = expanduser(destination)
     if not overwrite and exists(destination):
@@ -42,6 +81,7 @@ def write_default_config(source, destination, overwrite=False):
     ensure_dir_exists(destination)
 
     shutil.copyfile(source, destination)
+    ensure_private_file(destination)
 
 
 def upgrade_config(config, def_config):
 
@@ -66,6 +66,7 @@
     load_config,
     config_location,
     ensure_dir_exists,
+    ensure_private_file,
     get_config,
     get_config_filename,
 )
@@ -660,6 +661,9 @@ def initialize_logging(self):
         if log_level.upper() == "NONE":
             handler = logging.NullHandler()
         else:
+            # Before the handler creates it, so the file never exists with
+            # the umask mode.
+            ensure_private_file(log_file)
             handler = logging.FileHandler(os.path.expanduser(log_file))
 
         level_map = {
@@ -1110,6 +1114,7 @@ def run_cli(self):
         history_file = self.config["main"]["history_file"]
         if history_file == "default":
             history_file = config_location() + "history"
+        ensure_private_file(history_file)
         history = FileHistory(os.path.expanduser(history_file))
         self.refresh_completions(history=history, persist_priorities="none")
 
 
@@ -4,7 +4,12 @@
 
 import pytest
 
-from pgcli.config import ensure_dir_exists, skip_initial_comment
+from pgcli.config import (
+    ensure_dir_exists,
+    ensure_private_file,
+    skip_initial_comment,
+    write_default_config,
+)
 
 
 def test_ensure_file_parent(tmpdir):
@@ -41,3 +46,60 @@ def test_ensure_other_create_error(tmpdir):
 )
 def test_skip_initial_comment(text, skipped_lines):
     assert skip_initial_comment(io.StringIO(text)) == skipped_lines
+
+
+posix_only = pytest.mark.skipif(os.name != "posix", reason="POSIX file modes")
+
+
+@posix_only
+def test_ensure_private_file_creates_owner_only(tmp_path):
+    path = tmp_path / "history"
+    ensure_private_file(str(path))
+    assert path.exists() and path.read_bytes() == b""
+    assert stat.S_IMODE(path.stat().st_mode) == 0o600
+
+
+@posix_only
+def test_ensure_private_file_tightens_existing_and_keeps_content(tmp_path):
+    path = tmp_path / "history"
+    path.write_text("select 1\n")
+    path.chmod(0o664)
+    ensure_private_file(str(path))
+    assert stat.S_IMODE(path.stat().st_mode) == 0o600
+    assert path.read_text() == "select 1\n"
+
+
+@posix_only
+def test_ensure_private_file_leaves_device_nodes_alone():
+    # history_file = /dev/null is the usual way to record nothing; running as
+    # root, a chmod here would change it for every user on the machine.
+    before = os.stat("/dev/null").st_mode
+    ensure_private_file("/dev/null")
+    assert os.stat("/dev/null").st_mode == before
+
+
+@posix_only
+def test_ensure_private_file_does_not_block_on_a_fifo(tmp_path):
+    import threading
+
+    fifo = tmp_path / "history"
+    os.mkfifo(fifo)
+    worker = threading.Thread(target=ensure_private_file, args=(str(fifo),), daemon=True)
+    worker.start()
+    worker.join(timeout=5)
+    assert not worker.is_alive(), "open() on a reader-less FIFO must not hang pgcli"
+
+
+@posix_only
+def test_ensure_private_file_ignores_a_directory(tmp_path):
+    ensure_private_file(str(tmp_path))
+    assert tmp_path.is_dir()
+
+
+@posix_only
+def test_write_default_config_is_owner_only(tmp_path):
+    source = tmp_path / "pgclirc"
+    source.write_text("[main]\n")
+    destination = tmp_path / "config"
+    write_default_config(str(source), str(destination))
+    assert stat.S_IMODE(destination.stat().st_mode) == 0o600