mapping vendor into sites/default
add defensive drupal default to avoid rm -r .