docs: clarify that malicious config files are not an attack vector