As mentioned in issue #118, provider files may contain passwords or API keys and should be restricted. Profiles/maps are probably OK with the defaults.