Whats best practices for handling Drupal 8 core file paths for vendor package.json I use drupal-vm when setting up my dev environment and have heard that setting up Drupal core files in the document root is a security issue and should be set in a different way.

So I have set my composer.json to:

 "merge-plugin": {
        "include": [
            "docroot/core/composer.json"
        ],
        "recurse": false,
        "replace": false,
        "merge-extra": false
    },
    "installer-paths": {
        "docroot/core": ["type:drupal-core"],
        "docroot/modules/contrib/{$name}": ["type:drupal-module"],
        "docroot/profiles/contrib/{$name}": ["type:drupal-profile"],
        "docroot/themes/contrib/{$name}": ["type:drupal-theme"],
        "docroot/drush/contrib/{$name}": ["type:drupal-drush"],
        "docroot/modules/custom/{$name}": ["type:drupal-custom-module"],
        "docroot/themes/custom/{$name}": ["type:drupal-custom-theme"]
    }


I get issues with the autoload not being able to find the vendor/autoload:

Warning: require(/var/www/site/docroot/vendor/autoload.php): failed to open stream: No such file or directory in /var/www/site/docroot/autoload.php on line 14


Whats is the best practice for placement of Drupal 8 core files?
I think this is a slight misinterpretation of the security risk.

The core/ directory needs to be in your DOCROOT; it has assets that the webserver needs to serve up (JS, CSS, and images).

The vendor/ directory should (mostly) be outside of your DOCROOT; some packages have files that shouldn't really be accessed by the webserver directly and have been the focus of recent SAs.

The exception to this are dependencies that need to be served up or be in the proper place, hence why people use the installer-paths to place modules, themes, and JS libraries in the right place.

While not universal, I would say that drupal-composer/drupal-project is a growing best practice, at least for starting points for websites.  This will place vendor/ outside of DOCROOT, take care of the autoloader and scaffold files, and set up a sane set of installer-paths.  Even if I am not using this directly, I look to its composer.json for inspiration.