Can a Drupal Site Administrator view contents of settings.php or some other file in file system? We are using Drupal 8.6.3. 

I want to store some configuration in file system (in settings.php or some other file outside Web Root). 

Can a Drupal Site Administrator view that configuration?

What parts of settings.php file can be viewed by a Drupal Site Administrator?
For brevity, it helps to think about this question in terms of roles/permissions (since "site admin" is an overloaded term): 

Does the ____ role have an escalated permission to:


Write arbitrary files to the server?
Execute arbitrary code on the server?


If the first/second answer is "Yes," the answer would be:

____ role could probably come up with a clever way to read the entire contents of settings.php by injecting/running arbitrary code.

&nbsp;

Generally, Drupal core tries to signal these potentially dangerous permissions with this warning:


  Warning: Give to trusted roles only; this permission has security implications.


However, there are many contrib modules out there that could have exploits (some known, some not) so you'll always have to take pro-active security steps like the principle of least privilege (if a role doesn't need a privilege to do the job, don't give it to them). 

This also applies to your whole system (DB, web server, etc.), not just Drupal.