Make sure the global config file is only readable by the owner

src/Composer/Command/ConfigCommand.php

@@ -110,6 +110,7 @@ EOT
         if ($input->getOption('global') && !$this->configFile->exists()) {
             touch($this->configFile->getPath());
             $this->configFile->write(array('config' => new \ArrayObject));
+            chmod($this->configFile->getPath(), 0600);
         }
 
         if (!$this->configFile->exists()) {

src/Composer/Config/JsonConfigSource.php

@@ -70,6 +70,8 @@ class JsonConfigSource implements ConfigSourceInterface
         }
         $manipulator = new JsonManipulator($contents);
 
+        $newFile = !$this->file->exists();
+
         // try to update cleanly
         if (call_user_func_array(array($manipulator, $method), $args)) {
             file_put_contents($this->file->getPath(), $manipulator->getContents());
@@ -80,5 +82,9 @@ class JsonConfigSource implements ConfigSourceInterface
             call_user_func_array($fallback, $args);
             $this->file->write($config);
         }
+
+        if ($newFile) {
+            chmod($this->file->getPath(), 0600);
+        }
     }
 }