hmm - where did my comments go?

Well accessing config.php has some sec issues as well like getting access to the password salt, database credentials ...