hook_requirements() for un-protected configuration directories

Thank you for creating this issue to improve Drupal.

We are working to decide if this task is still relevant to a currently supported version of Drupal. There hasn't been any discussion here for over 8 years which suggests that this has either been implemented or is no longer relevant. Your thoughts on this will allow a decision to be made.

Since we need more information to move forward with this issue, the status is now Postponed (maintainer needs more info). If we don't receive additional information to help with the issue, it may be closed after three months.

Thanks!

Things changed since the last discussions on this: at the time, many projects were still having drupal at the project root, but with the usual scaffolds, Drupal is most often under (root)/web these days, so there is no longer really a good reason not to create the config outside, e.g. in (root)/config. The same actually applies to the private file system, logs, and temporary directories, I think : we could easily have more security by default by setting these instead of just documenting to users how to create them.