@Terence -

That you are a WP-Config.php Heretic, and Blaspheme the security of WordPress is, in & of itself, not what invites my Torquemada upon you.

Rather, your feet are held to the fire on this spurious assertion of Config-danger, because this is no ordinary WordPress chit-chat and back-scratch blog. A link to WP-Tavern is installed on the Admin Dashboard of every WordPress installation out there, and many newcomers & novices could be in the audience.

It is not necessary that I save your eternal soul from the awful fate your willful words incur, but we do wish that the many supplicants who may come here seeking WordPress enlightenment, are not led astray.

You have modified your impetuous config-assertion to :[T]he SQL credentials [in wp-config.php] are in a known location and often. through inexperience or carelessness, not as well protected as they might be.

The SQL credentials are safeguarded in what amounts to a nuclear bunker. Is a nuclear bunker actually perfectly unassailable? No, it is not. But the fact is, the Read-Permissions that you do not have in order to access Chip Bennett's wp-config.php file (go ahead. you know exactly where it is. you can't, can you?) place the config-info behind the software version of a steel-reinforced concrete wall.

These config files, which everyone has, are seriously secure. There is nothing off-hand, casual or in any way even faintly irresponsible about the way that WordPress handles these data. Other website softwares use the same method. It is safe, secure, and sensible.

Now then, Terence, lay down upon the Rack. You will feel so much better when we have freed your spirit of these demons.

- Ted the Terrible ;)