I've installed DBman on Hypermart, and set permissions properly. www.mydomain.com/cgi-bin/dbman

Problem is, I can view the password file if I enter the file name. I can also view the database.
How do I stop this? Directory Indexing is turned off.

Can it be done via htaccess? Maybe if all other files except db.cgi were is another directory I could make them forbiddon to the web, or password protect the direcotry. and because db.cgi was NOT in that directory it could still be accesses.

Help!