The updater/update.log file should NOT be publicly accessible as it leaks information and also breaks code signing. It needs to be stored in the data folder.
Ref owncloud/core#23857 (comment)
cc @karlitschek @jospoortvliet @VicDeo
https://github.com/owncloud/updater/blob/62ce3ec4c4fac87c8263460491a016d5e8d959dc/app/config/container.php#L91 should use $CONFIG['datadirectory'].
agreed. I think I mentioned this in the past too that this should go into the data directory