The folder belongs outside the web root, the download route being the only way to the files: a warning is
logged when it is not, and an apache `.htaccess` refusing every request is written at its root anyway.
$storage = new LocalStorage();
$storage->put('2026/09/0f3a...', $uploadedFilename);
$handle = $storage->open('2026/09/0f3a...');
Make sure a web server does not send the stored files itself: an apache .htaccess refusing every request, and a warning when the folder is inside the web root, where it does not belong.
Make sure a web server does not send the stored files itself: an apache .htaccess refusing every request, and a warning when the folder is inside the web root, where it does not belong.