In my opinion, which I said in #wikimedia-tech before, they should be in MediaWiki: namespace of local projects (so, restricted to all local admins), not in any one wiki that hardly anyone pays attention to. Current setup is certainly a vector of attack for Commons.

This was also raised before here:
https://www.mediawiki.org/wiki/Topic:Uirl8i2lzklbbpy9

@stjn Yes, we are aware of this and will probably increase the level of protection in the future.
For now we want to leave it like this since at the moment the config pages for all the Communites have to be created and updated often. Also the format of the configs is likely to change in the beta-phase.

The pages do not allow regex, they are protected by TitleBlacklist from edits users not autoconfirmed. Also we have all pages on our watch lists and check every edit. Therefore the attack vector is reasonably small, at least for beta phase.

Well, I just saw this task and thought that it’s just moving chairs around the table when there’s a more pressing issue. Most communities have sysops or people involved with the project could’ve asked for global interface editing rights, so I’m not really convinced this was a wise thing to do, but I won’t bother you with further comments.