Where to store user content (for eg. pics) so that its more secure? Under app/ OR under public/?

[eluser]n0xie[/eluser]
[quote author="zrowcrypt" date="1286882116"]
1. I dont want the files to be accessed directly via a url by unauthenticated/logged in users.
2. Also, these pictures are suppose to have restrictions as who all out of a group can view it.
3. I dont want search ingines to crawl and store the pics and show them up when googled.

Any suggestions/pointers?

Thanks.[/quote]
Use a controller to serve the images. Let the controller check if the user is authenticated/allowed to see the image. If it is, load the image.