I was just reading through some literature over at Infopop.com, and came across the security suggestions.
http://infopop.com/support/ubbthreads/UBBthreads_security.html They suggested that you place config.inc.php either above your web root or in a password-protected directory. I don't think that having this file below your web root is unsafe, but I guess it could be if cgi files will run anywhere.
See if you're at risk by typing in the URL to your threads install and then putting in config.inc.php. If you see text come up, your password could be in there. For example, here at ThreadsDev, it seems you're not at risk.
https://www.ubbdev.com/forum/config.inc.php I have moved mine above the web root, so it's ultra-safe!
http://www.drumlines.org/threads/config.inc.php It's not there!
