Composer in Root.

After finding a few issues with moving the vendor directory, I decided to revert that change (removing an environment variable). With that change moving things back into the publicly accessible site it was necessary to implement a url rewrite rule to reject any requests to the vendor directory for security purposes.

Liberated the Vendor Dir

Removed the COMPOSER_VENDOR_DIR environment variable due to issues using create-project or global require.

Still working on a work around for create-project which seems to be acting inconsistently.

Security Issue - vendor directory is placed back into a publicly accessible folder, you can fix this by adding a web.config file to the vendor directory.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <security>
            <requestFiltering>
                <denyUrlSequences>
                    <add sequence="/" />
                </denyUrlSequences>
            </requestFiltering>
        </security>
    </system.webServer>
</configuration>