Placing config files in the config directory of a package does not create any issues.
Custom config files are not automatically loaded by the server. You have to load/read them with your own code. This is true for files in package directories or in the server config directory.
Files in the pub directory of a package can be retrieved with a browser. For example, [URL]http://localhost:5555/myPackage/myFile.cfg[/URL] can be used to retrieve a file named myFile.cfg from the pub directory depending upon the permissions specifed in the .access file in the pub directory. For this reason, you probably do not want to put config files (which are intended to be internal) in the pub directory. The risk is inadvertently exposing the config file to everyone.
#Integration-Server-and-ESB#Flow-and-Java-services#webMethods