Separate directories for web files and CI files

If possible, you should configure your server to use the web directory as the root (DocumentRoot in Apache). Then the rewrite directives are used primarily to remove index.php from the URL and don't have to deal with the sub-directory, because anything above the web directory is not accessible to the outside world.

Bonfire has a similar structure, and just uses an index.php in the main directory to tell you the server needs to be configured to point to the "public" sub-directory instead of the root directory, and the .htaccess file in the main directory simply disables indexes.

Bonfire

Practical CodeIgniter 3
CodeIgniter Testing Guide