For outbound authentication: store passwords, keys, and other credentials outside of the
code in a strongly-protected, encrypted configuration file or database that is protected
from access by all outsiders, including other local users on the same system. Properly
protect the key (CWE-320). If you cannot use encryption to protect the file, then make