concrete5/concrete5 — comment on commit ef78f3969447f02956e989e2557dc3b7450c1eae
File:  line 0
By Mnkras:

I think it would be a good idea to add a .htaccess file to the tmp directory with

order deny,allow
deny from all

In it, I think that would be even more secure. if the server doesn't support .htaccess then no biggie, it still has the index.html,