https://stevenroland.com/posts/why-composer-should-never-be-in-your-public-directory