[proposal] deny access to README.md via htaccess

[silverstripe]

[proposal] deny access to README.md via htaccess

[ss23]

I vote no. Instead we should devote time to refactoring SilverStripe such that the webroot only contains files that need to be accessible. Playing whack-a-mole with sensitive files is a losing battle.

[dhensby]

I agree (with @ss23). It's not great that everything is installed into the webroot with SS, but that doesn't mean we should be completely defensive about it.

If you have project repos where you're doing all your code (including sensitive readmes) in the webroot, then it's that internal process that needs overhauling and/or you need to add custom rules to your .htaccess