Fix: #0017380: IIS: add web.config to deny access to config/