prevent access to config folder