Issue #2408321 by mfb, D34dMan, C_Logemann, serg2, walterebert, sanduhrs, John Morahan: Support RFC 5785 by whitelisting the .well-known directory

Issue #2392153 by mparker17, hussainweb, chris.smith, alexpott, dawehner: Disallow composer.json and composer.lock from being indexed

Issue #1269780 by hswong3i, damien_vancouver, Agileware, ricardoamaro, alexpott, axel.rutz, yannickoo: Remove symlinks option from .htaccess

Issue #2382513 by mikeker, chris_hall_hu_cheng, joachim, joelpittet, alexpott, YesCT, quietone, mikeker, Jeroen, joris_lucius, katy5289, sivaji@knackforge.com: Regression fix: allow Drupal 8 to work without Apache mod_rewrite

Issue #2408013 by Aki Tendo, alexpott, Fabianx, dawehner, Crell, jhodgdon, Wim Leers, aspilicious: Adding Assertions to Drupal - Test Tools

Issue #2508666 by alexpott, pwolanin, benjy: Drupal 8 .htaccess rule to prevent php file access can be easily bypassed

Issue #2279105 by mgifford, nidaismailshah, thedavidmeister, amitgoyal, rpayanm, ameenkhan07, rakhimandhania, jhodgdon: Remove as many "..." and ellipsis characters from the codebase as possible without altering the meaning of text

Issue #2456025 by stefan.r, alexpott, klausi: Rest tests fail on PHP 5.6 because of always_populate_raw_post_data ini setting

Issue #2406681 by tstoeckler, hussainweb, alexpott, ParisLiakos, almaudoh, tadityar: Add an autoload.php in the repo root to control the autoloader of front controllers

Issue #462950 by pwolanin: Mitigate the security risks that come from IE and other browsers trying to sniff the mime type

Issue #1956698 by Gábor Hojtsy, xjm, alexpott, damiankloip, mgifford: Prevent access to YAML files using .htaccess and web.config.

Issue #1587270 by klausi, greggles, sun: Forbid execution of PHP files in subfolders by default (except those needed by core).

Issue #2016629 by larowlan, neclimdul, sun, alexpott, jibran, ParisLiakos, donquixote, effulgentsia, msonnabaum: Refactor bootstrap to better utilize the kernel.

Revert "Issue #2016629 by larowlan, neclimdul, sun, alexpott, jibran, ParisLiakos, donquixote, effulgentsia, msonnabaum: Refactor bootstrap to better utilize the kernel."

This reverts commit cda051c4.

Issue #2016629 by larowlan, neclimdul, sun, alexpott, jibran, ParisLiakos, donquixote, effulgentsia, msonnabaum: Refactor bootstrap to better utilize the kernel.

Issue #1599774 by longwave, kristofferwiklund, BTMash, marcingy | Letharion: .htaccess protections do not work on Apache 2.4 without mod_access_compat.

Issue #1587270 by klausi: Added comment in .htaccess describing how to forbid execution of PHP files in subfolders.

Issue #1962780 by David_Rothstein, petyovsky: Fixed 500 Internal server error on Apache 1.x servers after updating to Drupal 7.22.

Issue #670454 by pwolanin, cburschka, effulgentsia: Fixed Support HTTP Authorization in CGI environment.

Issue #1907704 by ultimateboy, totten, acrollet, greggles: Restrict temporary files created by text editors.

Issue #1733476 by greggles, BMDan: Fixed Make default htaccess rules protocol sensitive to avoid man-in-the-middle-attacks if users don't fully customize the rule.

Removed sig from global htaccess, create a new one in the config directory at install time which simply does a DenyFromAll, just like private files