[FIX] security: ir.config_parameter should not be readable by external users