Read this!

the file wich holds the passwords has the same name as the .db file. (by default)

By default the pass file is also stored in the same directory as all the other files..

Password snatching is real easy if you figure the .db name out..

Look at:
http://www.gossamer-threads.com/scripts/dbman/default.pass

If you download the password an intruder can try to break the pass using a simple unix-password-cracker..

Sugested solution:

1) place the .pass file in a directory with alternate name wich is hard to guess

2) even better: place the .pass file(s) outside the www directory (location not accessible throug browsers)

Remember: Don't abuse this information! Don't become a victim by making victims!

Regards;
Michiel de Weerd

Hope this helps (a lot!) ;-)

Michiel is right, much like you shouldn't have your auth directory in a publicly viewable directory, you shouldn't have the rest of your DBMan in one either. Always put it in a cgi-bin directory (it's not on this site as I want to show people the source).

Cheers,

Alex