config was accessible to anyone -> fixed