The nginx sample config security issue

[ptejada]

The sample nginx setup should include the rule to block all .ini files.

[KOTRET]

normally you won't place them in the www-folder, would you?

[ptejada]

The apache htaccess file in the project does include the directive to prevent the server from serving ini files, why not included the same for the nginx example?

[sdragnev]

The same applies to the tmp directory which is within the docroot.