One of the limitations of Open Source shopping carts is that access to the core code is possible and this creates a problem as everyone can understand how the application works and that in itself create a security problem.

It is therefore important to adopt some measures that can address these problems.

In OpenCart e-commerce, there are two important steps that are necessary after installation to give additional security to the shopping cart.

1. After installation, you should remove the /install/ directory immediately. You can do this through any FTP program.
2. Change the file permissions for the config.php file in both the root directory and the /admin/ directories to 444.

These are important steps necessary to secure your OpenCart installation.

Source: https://www.todhost.com/knowledgebase/721/Important-Security-Steps-After-an-OpenCart-Installation.html