>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3534311. --> Reported by: [phenaproxima](https://www.drupal.org/user/205645) Related to !578 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>The cPanel-compatible project template, which is based on our regular project template, includes Drush. This means that you get <code>vendor/bin/drush</code> in the web root.</p> <p>That seems not-good. It's somewhat mitigated by the use of the <code>drupal/core-vendor-hardening</code> plugin, which the cPanel template now includes as of v1.2.1, and which will put a <code>.htaccess</code> file in <code>vendor</code> to deny access to it from the web. On Apache-powered servers, anyway.</p> <p>It might make sense to remove Drush from the cPanel project template only. This would be more secure out of the box, and probably more suitable for people on cheap hosting. The bad news is that it means developers working on Drupal CMS projects built with the cPanel template will need to remember to install Drush on their own.</p> <p>Another option would be to move Drush to the <em>dev</em> dependencies of both templates, and tell Softaculous to use <code>composer create-project drupal/cms_cpanel --no-dev</code> when spinning up Drupal CMS projects.</p> <p>Or maybe a combination of both approaches? Move Drush to dev dependencies, and tell Softaculous to use <code>--no-dev</code> for extra safety.</p> <p>Or something else? Would love some input here, because we should address this (or decide not to) sooner rather than later.</p>