Security Issue

[neodite]

If running this from the "Manual Install" and keeping everything default as in github.

Navigating to http://siteurl.com/.env.production will offer the environment file to be downloaded by the user.

[askotx]

You could set:

$dotenv = new Dotenv\Dotenv(APPPATH);

to add .env file to application folder

[doelmi]

you can use .htaccess

#except .env file
RewriteRule ^(.env) - [F,L,NC]