diff --git a/download/extract.go b/download/extract.go
index ef4d7236..5afc08c9 100644
--- a/download/extract.go
+++ b/download/extract.go
@@ -171,7 +171,7 @@ func Unzip(src, dst string, paths map[string]string) (files map[string]string, e
 		} else {
 			targetDir := filepath.Dir(target)
 			if !util.Exists(targetDir) {
-				err = os.MkdirAll(targetDir, os.ModePerm)
+				err = os.MkdirAll(targetDir, 0700)
 				if err != nil {
 					return nil, errors.Wrap(err, "failed to create target dir for file")
 				}
diff --git a/pawnpackage/package.go b/pawnpackage/package.go
index 3fec57fc..4f48069b 100644
--- a/pawnpackage/package.go
+++ b/pawnpackage/package.go
@@ -156,7 +156,7 @@ func (pkg Package) WriteDefinition() (err error) {
 		if err != nil {
 			return errors.Wrap(err, "failed to encode package metadata")
 		}
-		err = ioutil.WriteFile(filepath.Join(pkg.LocalPath, "pawn.json"), contents, 0755)
+		err = ioutil.WriteFile(filepath.Join(pkg.LocalPath, "pawn.json"), contents, 0700)
 		if err != nil {
 			return errors.Wrap(err, "failed to write pawn.json")
 		}
@@ -166,7 +166,7 @@ func (pkg Package) WriteDefinition() (err error) {
 		if err != nil {
 			return errors.Wrap(err, "failed to encode package metadata")
 		}
-		err = ioutil.WriteFile(filepath.Join(pkg.LocalPath, "pawn.yaml"), contents, 0755)
+		err = ioutil.WriteFile(filepath.Join(pkg.LocalPath, "pawn.yaml"), contents, 0700)
 		if err != nil {
 			return errors.Wrap(err, "failed to write pawn.yaml")
 		}
diff --git a/pawnpackage/package_test.go b/pawnpackage/package_test.go
index d2ab595e..31f46a58 100644
--- a/pawnpackage/package_test.go
+++ b/pawnpackage/package_test.go
@@ -121,12 +121,12 @@ func TestPackage_Build(t *testing.T) {
 		pcxWorkspace := util.FullPath("./tests/build-auto-" + tt.name)
 		pcxVendor := filepath.Join(pcxWorkspace, "dependencies")
 
-		err := os.MkdirAll(filepath.Join(pcxWorkspace, "gamemodes"), 0755)
+		err := os.MkdirAll(filepath.Join(pcxWorkspace, "gamemodes"), 0700)
 		if err != nil {
 			panic(err)
 		}
 
-		err = ioutil.WriteFile(filepath.Join(pcxWorkspace, tt.args.pkg.Entry), tt.sourceCode, 0755)
+		err = ioutil.WriteFile(filepath.Join(pcxWorkspace, tt.args.pkg.Entry), tt.sourceCode, 0700)
 		if err != nil {
 			panic(err)
 		}
diff --git a/pkgcontext/build.go b/pkgcontext/build.go
index 7ace068f..6dcfbe98 100644
--- a/pkgcontext/build.go
+++ b/pkgcontext/build.go
@@ -88,7 +88,7 @@ func (pcx *PackageContext) Build(
 		atomic.AddUint32(&buildNumber, 1)
 
 		if buildFile != "" {
-			err2 := ioutil.WriteFile(buildFile, []byte(fmt.Sprint(buildNumber)), 0755)
+			err2 := ioutil.WriteFile(buildFile, []byte(fmt.Sprint(buildNumber)), 0700)
 			if err2 != nil {
 				print.Erro("Failed to write buildfile:", err2)
 			}
@@ -246,7 +246,7 @@ loop:
 				}
 
 				if buildFile != "" {
-					err2 := ioutil.WriteFile(buildFile, []byte(fmt.Sprint(buildNumber)), 0755)
+					err2 := ioutil.WriteFile(buildFile, []byte(fmt.Sprint(buildNumber)), 0700)
 					if err2 != nil {
 						print.Erro("Failed to write buildfile:", err2)
 					}
@@ -352,7 +352,7 @@ func readInt(file string) (n uint32, err error) {
 		}
 		n = uint32(result)
 	} else {
-		err = ioutil.WriteFile(file, []byte("0"), 0755)
+		err = ioutil.WriteFile(file, []byte("0"), 0700)
 		n = 0
 	}
 	return
diff --git a/pkgcontext/cache_test.go b/pkgcontext/cache_test.go
index b5b3a92c..dbf34924 100644
--- a/pkgcontext/cache_test.go
+++ b/pkgcontext/cache_test.go
@@ -62,7 +62,7 @@ func TestEnsureDependenciesCached(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			os.RemoveAll(tt.pcx.Package.LocalPath)
-			os.MkdirAll(tt.pcx.Package.LocalPath, 0755) //nolint
+			os.MkdirAll(tt.pcx.Package.LocalPath, 0700) //nolint
 
 			tt.pcx.GitHub = gh
 			tt.pcx.GitAuth = gitAuth
diff --git a/pkgcontext/ensure_test.go b/pkgcontext/ensure_test.go
index 7f4786f9..9bb2a004 100644
--- a/pkgcontext/ensure_test.go
+++ b/pkgcontext/ensure_test.go
@@ -41,7 +41,7 @@ func TestPackage_EnsureDependencies(t *testing.T) {
 	}
 	for _, tt := range tests {
 		os.RemoveAll(tt.pcx.Package.LocalPath)
-		os.MkdirAll(tt.pcx.Package.LocalPath, 0755) //nolint
+		os.MkdirAll(tt.pcx.Package.LocalPath, 0700) //nolint
 
 		tt.pcx.GitHub = gh
 		tt.pcx.Platform = runtime.GOOS
diff --git a/rook/install_test.go b/rook/install_test.go
index 910a47e0..0b798e03 100644
--- a/rook/install_test.go
+++ b/rook/install_test.go
@@ -44,9 +44,9 @@ func Test_PackageInstall(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			dir := filepath.Join("./tests/install", tt.name)
 			os.RemoveAll(dir)
-			os.MkdirAll(dir, 0755)
+			os.MkdirAll(dir, 0700)
 
-			ioutil.WriteFile(filepath.Join(dir, "pawn.json"), tt.pkg, 0755) // nolint
+			ioutil.WriteFile(filepath.Join(dir, "pawn.json"), tt.pkg, 0700) // nolint
 
 			pcx1, err := pkgcontext.NewPackageContext(gh, gitAuth, true, dir, runtime.GOOS, "./tests/cache", "", false)
 			if err != nil {
diff --git a/runtime/all_test.go b/runtime/all_test.go
index 73fdeb41..e1223d0f 100644
--- a/runtime/all_test.go
+++ b/runtime/all_test.go
@@ -46,9 +46,9 @@ func TestMain(m *testing.M) {
 }
 
 func fakeServerDir(path string) {
-	os.MkdirAll(filepath.Join(path, "gamemodes"), 0755)
-	os.MkdirAll(filepath.Join(path, "filterscripts"), 0755)
-	os.MkdirAll(filepath.Join(path, "plugins"), 0755)
+	os.MkdirAll(filepath.Join(path, "gamemodes"), 0700)
+	os.MkdirAll(filepath.Join(path, "filterscripts"), 0700)
+	os.MkdirAll(filepath.Join(path, "plugins"), 0700)
 	f, _ := os.Create(filepath.Join(path, "gamemodes", "rivershell.amx"))
 	f.Close() // nolint
 	f, _ = os.Create(filepath.Join(path, "filterscripts", "admin.amx"))
diff --git a/runtime/ensure_plugins.go b/runtime/ensure_plugins.go
index 9d7f8fe6..922a0e9e 100644
--- a/runtime/ensure_plugins.go
+++ b/runtime/ensure_plugins.go
@@ -155,7 +155,15 @@ func EnsureVersionedPlugin(
 	} else {
 		print.Verb(meta, "plugin resource is a single file")
 		base := filepath.Base(filename)
-		destination := filepath.Join(dir, "plugins", base)
+		finalDir := filepath.Join(dir, "plugins")
+		destination := filepath.Join(finalDir, base)
+		
+		err = os.MkdirAll(finalDir, 0700)
+		if err != nil {
+			err = errors.Wrapf(err, "failed to create path for plugin resource %s to %s", filename, destination)
+			return
+		}
+
 		err = util.CopyFile(filename, destination)
 		if err != nil {
 			err = errors.Wrapf(err, "failed to copy non-archive file %s to %s", filename, destination)
@@ -214,7 +222,6 @@ func PluginFromCache(
 	cacheDir string,
 ) (hit bool, filename string, resource *resource.Resource, err error) {
 	resourcePath := filepath.Join(cacheDir, GetResourcePath(meta))
-
 	print.Verb("getting plugin resource from cache", meta, resourcePath)
 
 	pkg, err := pawnpackage.GetCachedPackage(meta, cacheDir)
@@ -224,6 +231,9 @@ func PluginFromCache(
 		hit = false
 		return
 	}
+	if pkg.Format == "" {
+		return
+	}
 
 	files, err := ioutil.ReadDir(resourcePath)
 	if err != nil {
@@ -275,7 +285,7 @@ func PluginFromNet(
 	print.Info(meta, "downloading plugin resource for", platform)
 
 	resourcePathOnly := GetResourcePath(meta)
-	resourcePath := filepath.Join(cacheDir, resourcePathOnly)
+	resourcePath := filepath.Join(cacheDir, resourcePathOnly)	
 
 	err = os.MkdirAll(resourcePath, 0700)
 	if err != nil {
@@ -283,14 +293,11 @@ func PluginFromNet(
 		return
 	}
 
-	pkg, err := pawnpackage.GetCachedPackage(meta, cacheDir)
+	pkg, err := pawnpackage.GetRemotePackage(ctx, gh, meta)
 	if err != nil {
-		pkg, err = pawnpackage.GetRemotePackage(ctx, gh, meta)
-		if err != nil {
-			err = errors.Wrap(err, "failed to get remote package definition file")
-			return
-		}
-	}
+		err = errors.Wrap(err, "failed to get remote package definition file")
+		return
+	}	
 
 	resource, err = GetResource(pkg.Resources, platform, version)
 	if err != nil {
@@ -317,20 +324,32 @@ func PluginFromNet(
 func GetResource(resources []resource.Resource, platform string, version string) (*resource.Resource, error) {
 	if version == "" {
 		version = "0.3.7"
-	}
+	}	
 
+	found := false
 	var tmp *resource.Resource
 	for _, res := range resources {
 		if res.Platform == platform {
-			if res.Version == "" || res.Version == version {
+			if res.Version == version {
 				tmp = &res
+				found = true
 				break
 			}
 		}
 	}
-	if tmp == nil {
-		return nil, errors.Errorf("plugin does not provide binaries for target platform %s and version %s", platform, version)
+	if !found {
+		for _, res := range resources {
+			if res.Platform == platform && res.Version == "" {
+				print.Verb("no resource matching version: ", version, ", falling back to the first resource matching platform: ", platform)
+				tmp = &res
+				found = true
+				break;
+			} 
+		}
 	}
+	if !found {
+		return nil, errors.Errorf("plugin does not provide binaries for target platform %s and/or version %s", platform, version)						
+	}	
 
 	if err := tmp.Validate(); err != nil {
 		return nil, errors.Wrap(err, "matching resource found but is invalid")
diff --git a/runtime/ensure_plugins_test.go b/runtime/ensure_plugins_test.go
index 0d20c6d9..203fb98a 100644
--- a/runtime/ensure_plugins_test.go
+++ b/runtime/ensure_plugins_test.go
@@ -70,7 +70,7 @@ func TestEnsurePlugins(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			tt.args.cfg.WorkingDir = filepath.Join("./tests/ensure", tt.name)
-			os.MkdirAll(tt.args.cfg.WorkingDir, 0755)
+			os.MkdirAll(tt.args.cfg.WorkingDir, 0700)
 
 			t.Log("First call to Ensure - from internet")
 			err := EnsurePlugins(context.Background(), gh, &tt.args.cfg, "./tests/cache", true)
diff --git a/util/util_test.go b/util/util_test.go
index a4d404d8..780e4844 100644
--- a/util/util_test.go
+++ b/util/util_test.go
@@ -8,7 +8,7 @@ import (
 )
 
 func TestMain(m *testing.M) {
-	os.MkdirAll("./tests", 0755)
+	os.MkdirAll("./tests", 0700)
 
 	f, _ := os.Create("./tests/file")
 	f.Close() // nolint