Security: plugin-config should not me world readable as it might contain passwords