The Nginx configuration, which is recommended by the documentation, allows public access to the hidden server files (e.g., «.htaccess») inside the «web» folder

[dmitrii-fediuk]

I propose to add the rule:

location ~ /\. {deny all;}

https://www.orocrm.com/documentation/2.0/book/installation#step-3-web-server-configuration

[vbyndych]

Thank you for your suggestion. We will check our guide.

Internal ID: OD-323