Keep private files outside the document root

Steps

Set the host DocumentRoot to this application's public/, never its root or the original framework. Keep configuration, vendor, guides, sessions, account records, quotas, and audit files outside public.

public/                 web-visible static assets + app.php
app/, config/, vendor/  private code and composition
resources/content/     private approved documentation revisions
storage/runtime/ENV/   private environment-isolated state

Disable directory indexes and deny hidden/development PHP files. Do not rely on .htaccess to hide a wrongly exposed application root. Source examples are selected from a fixed private import allowlist and served only as escaped, authenticated article text.

Verify

Request representative private and hidden paths anonymously and check denial without bytes. See Directory structure and the local deployment runbook.

Candidate quarantine is a separate opt-in boundary

The candidate supplies private quarantine and no-replace publication; the KB has not installed or enabled them. Compose FileQuarantine with a dedicated PrivateWorkspace, scanner, inspector, private storage, application policy, required audit sink, clock and environment. Keep upload sources out of public mappings and authorize callers independently of module preferences.

Illustrative use-case fragment, signature-checked but not executed here:

// The application injects FileQuarantine and obtains this actor ID from its
// authenticated identity mapping, never an arbitrary request parameter.
// Retention is an application-reviewed integer in seconds (1..31,536,000).
$quarantineId = $quarantine->capture($privateUploadPath, $approvedRetentionSeconds);

// Publish enforces the injected policy, scan, inspection and required audit.
// Return only an application-authorized reference, never the held file path.
$storedObject = $quarantine->publish($quarantineId, $authenticatedActorId);

Do not claim capture means clean. The optional qualified ClamAV wrapper needs operator-approved exact definition pins and a valid qualification window. It does not update feeds or renew trust. Expired or changed definitions deny. Observed source/state/lock substitutions and integrity failures deny rather than repair files. HELD is not a publication grant; ambiguous SCANNING, RELEASING or DELETING requires separately authorized manual reconciliation. An error after no-replace publication may mean the object already exists. Never reset state or retry blindly. See scanner/quarantine and native operations for wiring, filesystem prerequisites and outer-container/host limitations. Private audit history has its own strict filesystem and search contract, not a file-plus-SQL transaction or same-UID sandbox.

Editorial provenance

Source: resources/guides/private-files.md. Source SHA-256: 14e4e8e94613391655ace283a7f9f769f58eabd4a4bae71e01ebd2f28553129a.

Knowledge-base application source; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.