It's a little trickier than that, because a KeePass user may work with multiple password databases (e.g. one for themselves, a shared one for their team, etc.),

It's a little trickier than that, because a KeePass user may work with multiple password databases (e.g. one for themselves, a shared one for their team, etc.), and the user almost certainly wants one configuration that applies to all of them. Maybe something like the first time a particular database is opened, KeePass could ask the user to approve the settings in the config file, and if so, add a cryptographic signature based on the config file hash and the database's master key to a separate config file that stored a list of those signatures and the config settings that were present when they were generated.[1] The next time the same database is opened, KeePass would only re-prompt if the signature no longer matched. That way, if the config file changed separately, the user could get a warning popup highlighting what had changed. [1] Alternatively, have everything in one file, and strip the "existing signatures" block before generating the hash, but it seems safer to use a separate file.