Config file can be downloaded, contains a hashed password. Can either be stored outside of the root or have the directory locked down.