You are right, it wil expose the front controller, but it wont expose the includes from there. If you screw up the open tag on the config file, even if it is ou

You are right, it wil expose the front controller, but it wont expose the includes from there. If you screw up the open tag on the config file, even if it is outside of webroot it will be exposed I just tested a few variations on one of my old projects and the reason why I didn't see it is because I had ob_start() and was killing the buffer in my templating class (which is a good idea) not to mention that the db passwords were in an external yaml file anyway (most of the frameworks do this) which would get loaded and cached