Application files and private storage must remain outside the public document root.
