Put 'Deny from all' to vendor/.htaccess file
Release