>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3580694. --> Reported by: [phenaproxima](https://www.drupal.org/user/205645) Related to !866 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>In Drupal, it's considered a best practice to keep sensitive info, like exported config, away from prying eyes. One known way of doing this is to keep it in a directory next to the web root. Our project template uses a relocated web root, so we could do this, but currently do not. We should do it by default, in accordance with best practices.</p>