At the moment, there is no consequences if the configuration file is having too permissive read permissions. It would be helpful to have a check that would issue a warning in case the credentials are read from a config file AND the file got too much permission. It should not be higher than 600 (read/write for the user only).