config.json can be downloaded from the web and expose db credentials

[mauntrelio]

config.json file should be put in another folder (not reachable from the web but available to PHP and python script for reading) or protected somehow, otherwise it could be downloaded from the web and expose db credentials and other sensitive configuration parameters.

[paskino]

maybe worth using htaccess for that?

[mauntrelio]

I think your approach was better, I would use again a .config file (in JSON format to enable easy sharing between different programming languages) + using .htaccess file to prevent access to any . file