Disable access to php scripts in /storage

config/nginx/in-vhost.conf

@@ -16,6 +16,11 @@ server {
     location = /favicon.ico { access_log off; log_not_found off; }
     location = /robots.txt  { access_log off; log_not_found off; }
 
+
+    location ~* /storage/.*\.php$ {
+        return 503;
+    }
+
     location ~ \.php$ {
         fastcgi_split_path_info ^(.+\.php)(/.+)$;
         fastcgi_pass app:9000;