where CSS and JS directory?

[eluser]GSV Sleeper Service[/eluser]

I hear this all the time, but I’ve yet to hear a good argument or explanation of how exactly doing such could compromise the security of your app.

in the rare occurrence that something goes wrong and apache starts serving your .php files as text files, a quick visit to yourdomain.com/application/config/database.php would reveal some potentially damaging information.

A similar thing happened to facebook about 6 months or so ago. (apache AddType directive went wrong and php code was exposed)