Where to store user content (for eg. pics) so that its more secure? Under app/ OR under public/?

[eluser]zrowcrypt[/eluser]
Will .htaccess be able to stop members from accessing (members)images from the public folder directly...i mean for eg if they type a valid url of an image in the browser directly (http://site.com/pub/images/member2/profile.jpg), can .htaccess deny those ?

Thanks.