System and Application folder locations

[eluser]Dam1an[/eluser]
I agree, putting the application and core folders out of the web root is the way to go, although not everyone has access above the web root, in which case the next line of defense is to put the define basepath check in all your files (why is that not at the start of the welcome controller?)