@Chip Bennett - well if its not exploitable, why does the codex suggest "hardening" by moving the wp-config.php file elsewhere? Seems to me, if its so safe, there's no need. You can't have it both ways. But the whole idea of leaving those credentials in plain text, no matter how many other programs do it as well, seems to my non-developer (il)logical thinking, to be an accident just waiting to happen. And for @Ipstenu to say they all do, so its OK, to me seems rather like saying - "those cars all have lousy brakes, it doesn't matter if my car has lousy brakes too".