Exposed Access Credentials *NOT* within document root. But, if you have to...