Status report has a false-positive for SA-CORE-2013-003
The Status Report page says, "See http://drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess file which should be added to the db://active_config directory to help protect against arbitrary code execution." This is nonsense, as the db://active_config cannot be served by the web server.
Check that the active config is a directory and only emit the warning if it is.