why should they have access to the secondary file??
If you're on a server, you can easily set permissions for files, and you can put the file somewhere unreachable by others without proper permission.

As you can encrypt the passwords