Is it a security risk to put Craft templates inside public root? Due to the way our build and deployment process works, it's convenient for us to have the Craft templates inside our /public/assets folder together with our css and javascript, instead of in /craft. Does this make the site less secure than having them outside of the public root?
If you’re running Apache, you can put a .htaccess file in your templates/ folder with this in it:

Deny from all


and any HTTP traffic to that folder will be given an Apache 403 error.

Even better, you can put this in there:

# Send the request to Craft
RewriteEngine On
RewriteRule (.*) /index.php?p=$1 [QSA,L]


and the request will be redirected to Craft’s index.php file behind the scenes, the same way that would-be 404s are sent there. So even if you go to /templates/index.html, or any other URL that points to an actual file within your templates/ folder, it will end up as /index.php?p=templates/index.html, leaving Craft to handle the request, which will most likely result in a Craft-based 404.