title: Composer: where should I put the "vendor" folder?
body: <p>I have concerns that are similar to what were addressed <a href="https://stackoverflow.com/questions/23579984/security-should-i-move-vendor-dir-and-composer-json-outside-of-document-root">here</a>. I'm using Composer to install Amazon AWS components to set up a SES (email) service.</p>
  
  <p>According to the Amazon <a href="http://docs.aws.amazon.com/aws-sdk-php/guide/latest/installation.html" rel="noreferrer">documentation</a>, I need to include <code>autoload.php</code> in order to use the classes that I installed. This means that the <code>autoload.php</code> must be in my web directory (/var/www/html). </p>
  
  <p>I didn't fully understand the answer provided to the SO question I previous mentioned, but it essentially says that the vendor directory should NOT be in the web directory. But if I do this, how will I <code>require</code> the <code>autoload.php</code> file, which is in the /vendor directory?</p>
  
  <p>Overall I am very confused about how I should be properly setting this up. Any help would be appreciated.</p>
  
  <p><strong>Edit:</strong> <a href="https://www.digitalocean.com/community/tutorials/how-to-install-and-use-composer-on-your-vps-running-ubuntu" rel="noreferrer">This</a> article also suggests putting the /vendor/ folder in the web directory. Is this the standard? What security risks should I be looking out for? Because there are no index.html files or anything in any of the folders, the directories of all the files that were installed can be seen and accessed freely. Surely this can't be a good thing?</p>