The password in the config.xml is stored in plain text. This is a security
risk. Either the passwords should be hashed or the entire config file should
be encrypted.