diff --git a/CHANGELOG.md b/CHANGELOG.md
index 598687cb8..a6e705291 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [PEP 440](https://www.python.org/dev/peps/pep-0440/)
 and uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+## [0.4.7]
+### Fixed
+* [617](https://github.com/dbekaert/RAiDER/issues/617) - RAiDER created `.netrc` is too permissive
+
 ## [0.4.6]
 
 ### Added
diff --git a/tools/RAiDER/s1_orbits.py b/tools/RAiDER/s1_orbits.py
index 3aaa278a0..f4475940d 100644
--- a/tools/RAiDER/s1_orbits.py
+++ b/tools/RAiDER/s1_orbits.py
@@ -29,7 +29,7 @@ def ensure_orbit_credentials() -> Optional[int]:
 
     # netrc needs a netrc file; if missing create an empty one.
     if not netrc_file.exists():
-        netrc_file.touch()
+        netrc_file.touch(mode=0o600)
 
     netrc_credentials = netrc.netrc(netrc_file)
     if ESA_CDSE_HOST in netrc_credentials.hosts: