disallow access to composer files