I noticed in
default.settings.php this comment:
Location of the site configuration files.
The $config_directories array specifies the location of file system directories used for configuration data. On install, "active" and "staging" directories are created for configuration. The staging directory is used for configuration imports; the active directory is not used by default, since the default storage for active configuration is the database rather than the file system (this can be changed; see "Active configuration settings" below).
The default location for the active and staging directories is inside a randomly-named directory in the public files path; this setting allows you to override these locations. If you use files for the active configuration, you can enhance security by putting the active configuration outside your document root.
And then the example:
$config_directories = array( CONFIG_ACTIVE_DIRECTORY => '/some/directory/outside/webroot', CONFIG_STAGING_DIRECTORY => '/another/directory/outside/webroot', );
I also noticed that when you export to the directory you specify, an .htaccess file is added that denies access to the directory.
I understand that most people will not want their configuration available for anyone to read, but what if your site is in a public repository?
Is there anything I should be concerned about? Could this data be used to exploit the site?