Update notes for submitted changes

* config files containing passwords shouldn't be world-readable