diff --git a/lua/cp/cache.lua b/lua/cp/cache.lua
index 9448910..7ff1824 100644
--- a/lua/cp/cache.lua
+++ b/lua/cp/cache.lua
@@ -57,6 +57,7 @@ function M.load()
 
   if vim.fn.filereadable(cache_file) == 0 then
     vim.fn.writefile({}, cache_file)
+    vim.fn.setfperm(cache_file, 'rw-------')
     loaded = true
     return
   end
@@ -107,6 +108,7 @@ function M.save()
     local encoded = vim.json.encode(cache_data)
     local lines = vim.split(encoded, '\n')
     vim.fn.writefile(lines, cache_file)
+    vim.fn.setfperm(cache_file, 'rw-------')
   end)
 end
 
diff --git a/lua/cp/credentials.lua b/lua/cp/credentials.lua
index a1258c4..f644ecf 100644
--- a/lua/cp/credentials.lua
+++ b/lua/cp/credentials.lua
@@ -117,6 +117,7 @@ function M.logout(platform)
     if ok and type(data) == 'table' then
       data[platform] = nil
       vim.fn.writefile({ vim.fn.json_encode(data) }, cookie_file)
+      vim.fn.setfperm(cookie_file, 'rw-------')
     end
   end
   logger.log(display .. ' credentials cleared', { level = vim.log.levels.INFO, override = true })
diff --git a/lua/cp/scraper.lua b/lua/cp/scraper.lua
index 02f20b3..4ad46bc 100644
--- a/lua/cp/scraper.lua
+++ b/lua/cp/scraper.lua
@@ -344,7 +344,7 @@ function M.login(platform, credentials, on_status, callback)
   local done = false
   run_scraper(platform, 'login', {}, {
     ndjson = true,
-    env_extra = { CP_CREDENTIALS = vim.json.encode(credentials) },
+    stdin = vim.json.encode(credentials),
     on_event = function(ev)
       if ev.credentials ~= nil and next(ev.credentials) ~= nil then
         require('cp.cache').set_credentials(platform, ev.credentials)
@@ -392,9 +392,9 @@ function M.submit(
   local done = false
   run_scraper(platform, 'submit', { contest_id, problem_id, language, source_file }, {
     ndjson = true,
-    env_extra = { CP_CREDENTIALS = vim.json.encode(credentials) },
+    stdin = vim.json.encode(credentials),
     on_event = function(ev)
-      if ev.credentials ~= nil then
+      if ev.credentials ~= nil and next(ev.credentials) ~= nil then
         require('cp.cache').set_credentials(platform, ev.credentials)
       end
       if ev.status ~= nil then
diff --git a/scrapers/base.py b/scrapers/base.py
index 035495a..e98990c 100644
--- a/scrapers/base.py
+++ b/scrapers/base.py
@@ -36,6 +36,7 @@ def save_platform_cookies(platform: str, data: Any) -> None:
         existing = {}
     existing[platform] = data
     _COOKIE_FILE.write_text(json.dumps(existing))
+    _COOKIE_FILE.chmod(0o600)
 
 
 def clear_platform_cookies(platform: str) -> None:
@@ -43,6 +44,7 @@ def clear_platform_cookies(platform: str) -> None:
         existing = json.loads(_COOKIE_FILE.read_text())
         existing.pop(platform, None)
         _COOKIE_FILE.write_text(json.dumps(existing))
+        _COOKIE_FILE.chmod(0o600)
     except Exception:
         pass
 
@@ -160,7 +162,7 @@ class BaseScraper(ABC):
                         ).model_dump_json()
                     )
                     return 1
-                creds_raw = os.environ.get("CP_CREDENTIALS", "{}")
+                creds_raw = sys.stdin.read()
                 try:
                     credentials = json.loads(creds_raw)
                 except json.JSONDecodeError:
@@ -173,7 +175,7 @@ class BaseScraper(ABC):
                 return 0 if result.success else 1
 
             case "login":
-                creds_raw = os.environ.get("CP_CREDENTIALS", "{}")
+                creds_raw = sys.stdin.read()
                 try:
                     credentials = json.loads(creds_raw)
                 except json.JSONDecodeError:
diff --git a/scrapers/kattis.py b/scrapers/kattis.py
index 8b0099f..4417628 100644
--- a/scrapers/kattis.py
+++ b/scrapers/kattis.py
@@ -415,7 +415,6 @@ class KattisScraper(BaseScraper):
                     return LoginResult(
                         success=True,
                         error="",
-                        credentials={"username": username, "password": password},
                     )
 
             print(json.dumps({"status": "logging_in"}), flush=True)
@@ -426,7 +425,6 @@ class KattisScraper(BaseScraper):
         return LoginResult(
             success=True,
             error="",
-            credentials={"username": username, "password": password},
         )
 
 
diff --git a/scrapers/usaco.py b/scrapers/usaco.py
index e463881..d878886 100644
--- a/scrapers/usaco.py
+++ b/scrapers/usaco.py
@@ -533,7 +533,6 @@ class USACOScraper(BaseScraper):
                     return LoginResult(
                         success=True,
                         error="",
-                        credentials={"username": username, "password": password},
                     )
 
             print(json.dumps({"status": "logging_in"}), flush=True)
@@ -549,7 +548,6 @@ class USACOScraper(BaseScraper):
         return LoginResult(
             success=True,
             error="",
-            credentials={"username": username, "password": password},
         )