Hi,

I am new to elgg. I am in fact considering starting using it.

After the installation process, I see that the settings.php (which contains among other things the database password) is located inside the root folder (in the elgg-config sub folder of the root folder).

I know elgg is a well establish software and I hence believe it is me who does not understand something and not the project that is wrong. I am trying to understand if this is safe.

My understanding would be that such credential should be in a file located outside of the root folder. I would also think that proper permission on the settings.php could alternatively do the trick. I however see no instruction to set permission that would prevent read of this file from the outside world. 

What am I missing?

Thanks a lot!