docs(security): Prevent direct browser access to logs

Author: noplanalderson

README.md

@@ -152,6 +152,81 @@ Request → CI3 Hook (post_controller_constructor)
 The write is a single append with `LOCK_EX`, so it does not block the request
 and is safe for concurrent PHP-FPM workers.
 
+## Security
+
+CI3 places `index.php` in the same directory as `application/`, so by default
+everything under `application/` — including `application/logs/analysis.log`,
+which contains request headers and bodies — is reachable directly from the
+browser (`http://host/application/logs/analysis.log`). Apply at least one of
+the layers below; using all three is recommended.
+
+### 1. Keep `application/` out of the web root (recommended)
+
+Move the front controller so the public web root only contains `index.php`,
+`.htaccess` and assets:
+
+```
+project/
+├── application/          ← not web-accessible
+├── system/
+└── public/               ← document root
+    ├── index.php
+    └── .htaccess
+```
+
+Then fix the paths in `public/index.php` (a copy of the original, with
+`$system_path`/`$application_folder` updated to `../system` and `../application`)
+and set `$config['base_url']` accordingly in `application/config/config.php`.
+
+### 2. Redirect the log directory outside the web root
+
+Even with the default layout, point logs somewhere the browser cannot reach:
+
+```ini
+REQUEST_LOG_DIR = "/var/log/myapp/request-analysis"
+```
+
+The hook falls back to `application/logs` only when `REQUEST_LOG_DIR` is empty.
+
+### 3. Deny access with the web server
+
+**Apache** — ship an `.htaccess` inside the log directory (and the
+`application/` directory) with:
+
+```apache
+<IfModule mod_authz_core.c>
+    Require all denied
+</IfModule>
+<IfModule !mod_authz_core.c>
+    Order deny,allow
+    Deny from all
+</IfModule>
+```
+
+The sample app already includes `sample/application/logs/.htaccess` and
+`sample/application/uploads/.htaccess`. If `AllowOverride` is disabled, deny
+the paths in the vhost instead:
+
+```apache
+<Directory "/path/to/app/application/logs">
+    Require all denied
+</Directory>
+```
+
+**Nginx**:
+
+```nginx
+location ~ ^/(application|system)/ {
+    deny all;
+}
+location ^~ /application/logs/ {
+    deny all;
+}
+```
+
+**Laravel-style check** — as a last line of defense, `application/logs/.htaccess`
+also rejects `*.log` / `*.gz` matches even if directory-level rules are ignored.
+
 ## Notes
 
 - The hook runs on every request once enabled. To log only specific