Our tutor in my first year uni course taught us to put sensitive information into a folder outside the web path, and use relative paths to include the files whe

Our tutor in my first year uni course taught us to put sensitive information into a folder outside the web path, and use relative paths to include the files where needed. There is absolutely zero reason these sensitive files should be accessible via URL.