Depending on your web server you may have to configure your server to deny web access to the files/ and store/ directories. This is to prevent users from accessing private attachments and database backups.
For apache there are .htaccess files already in place to do this for you. For other webservers you will have to adjust the configuration yourself. There are sample configuration files for lighttpd and nginx in the docs/ directory.
For apache there are .htaccess files already in place to do this for you. For other webservers you will have to adjust the configuration yourself. Sample files for nginx and lighttpd to help you get started may be found in docs directory.