diff --git a/litellm/proxy/client/cli/commands/up.py b/litellm/proxy/client/cli/commands/up.py
index dc9157d7ca4..4b077398b32 100644
--- a/litellm/proxy/client/cli/commands/up.py
+++ b/litellm/proxy/client/cli/commands/up.py
@@ -221,7 +221,7 @@ def up(ctx: click.Context) -> None:
 
         CLAUDE_SETTINGS_PATH.parent.mkdir(exist_ok=True)
         merged = merge_claude_settings(original_settings, base_url, api_key_helper)
-        with open(CLAUDE_SETTINGS_PATH, "w") as f:
+        with secure_create(CLAUDE_SETTINGS_PATH) as f:
             json.dump(merged, f, indent=2)
     except (AgentRunError, UpError) as e:
         raise click.ClickException(str(e))
diff --git a/tests/test_litellm/proxy/client/cli/test_up_commands.py b/tests/test_litellm/proxy/client/cli/test_up_commands.py
index 1b182553644..26b00f98365 100644
--- a/tests/test_litellm/proxy/client/cli/test_up_commands.py
+++ b/tests/test_litellm/proxy/client/cli/test_up_commands.py
@@ -324,6 +324,7 @@ class TestUpCommand:
         def fake_wait(self, timeout=None):
             captured["settings"] = json.loads(settings_path.read_text())
             captured["backup_existed"] = backup_path.exists()
+            captured["settings_mode"] = stat.S_IMODE(settings_path.stat().st_mode)
             return True
 
         with (
@@ -346,6 +347,7 @@ class TestUpCommand:
         assert captured["settings"]["theme"] == "dark"
         assert captured["settings"]["env"]["ANTHROPIC_BASE_URL"] == "http://localhost:4000"
         assert captured["settings"]["apiKeyHelper"] == "/usr/local/bin/lite auth print-token"
+        assert captured["settings_mode"] == 0o600
         assert json.loads(settings_path.read_text()) == original
         assert not backup_path.exists()