Lax Vale

How can I prevent Drupal’s public file system from exposing private configuration files accidentally?

I want to ensure that files placed in Drupal’s public file system are not unintentionally served to visitors when they contain sensitive information such as configuration exports or logs. The site uses the default public file path defined in admin/config/media/file-system, and I am unsure whether additional server‑level restrictions are required to block acc