Locate Database Config File Outside Route Directory (security)

Hi one of my client have flagged up that it is bad practice to have the DB config file located within the route directory. Has anyone else had experience of locating this file elsewhere? Or point me in the right direction.
Thanks in advance.