Security Warning on Dashboard (pantheon / nginx)
Pantheon does not support .htaccess files nor custom location directives, which are the common approaches to protecting those files from access on Apache / Nginx.

However, moving your CiviCRM file directories from sites/default/files/civicrm to sites/default/private/civicrm should resolve this, because Pantheon protects that location out of the box.

See Drupal.org #2195947 - Security warning from Civi re exposed "files" directory for how this is addressed in CiviCRM StarterKit.

You will need to end up with something like this in your civicrm.settings.php, the linked issue above gives the required context needed to ensure $pantheon_conf contains appropriate values.

  global $civicrm_setting;
  $civicrm_setting['Directory Preferences']['uploadDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/files/private/civicrm/upload/';
  $civicrm_setting['Directory Preferences']['customFileUploadDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/files/private/civicrm/custom/';
  $civicrm_setting['Directory Preferences']['imageUploadDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/files/private/civicrm/persist/contribute/';
  $civicrm_setting['Directory Preferences']['extensionsDir'] = '/srv/bindings/' . $pantheon_conf['pantheon_binding'] . '/code/sites/all/extensions/';
  $civicrm_setting['URL Preferences']['extensionsURL'] = $base_url . '/sites/all/extensions';


See also the relevant CiviCRM security advisory, CIVI-SA-2014-001 Risk of information disclosure. Moving the restricted files outside the webroot entirely would be the ideal solution if/when CiviCRM supports that.