note that in prod, you should not execute app_dev.php or config.php as they would leak sensitive infoirmation (and not even deploy them)

I agree that it's best practice, but don't they just die because of the ip restriction? How do they leak info?

@stof It's a config for both dev & prod environment and I think we should include all required script names in it. It's a minimal configuration that allows developers to start using Symfony.
Also I'd like to mention that existing Apache config allows to useapp_dev.php andconfig.php. It is useful to have these scripts available on production but with limited availability (it is already done in these scripts):

• Before the first deployment deployment team should check that environment is really ready for the deployment
• There should be ability to debug on the production in case of any issues that can be reproduced only on prod.