config.yml permissions

I noticed that `config.yml` is set to be world readable. Given that this contains a secret, it would be nice if this could be readable only by the current user.