In my case I recently deployed a new site on a host, and after completing the install I found to my suprise if I just hit my site, mysite.com it had the full installation screen available to the public internet, so had I not been sitting right there, anyone who may be scanning the web, could have hit my url, and poof they could set it all up for their own. 

Of course I know best practices is build out the site in dev, then push to prod etc.  and that is my usual method.  However, in this case,  I had been considering this issue, and had noticed it in the past,and wanted to see if in the new version if this was fixed.

 Perhaps add a password page in front of the install page that requires some password setup in some other step or something? 

 Thoughts?