While getting my fingers dirty with Magento2 and tracing the webservers error log (using Apache2 on a virtualhost setup on my development box) I see sporadic reports on illegal access to one of the config files:
[Mon Dec 21 09:14:31.603958 2015] [access_compat:error] [pid 15805] [client 192.168.11.11:11111] AH01797: client denied by server configuration: /home/user/workspace/customer/customer-magento2-shop/shop/www/app/etc/config.php
The according request from access log is:
192.168.10.25 - - [21/Dec/2015:09:14:31 +0100] "POST /app/etc/config.php HTTP/1.1" 403 496 "-" "-"
I don't have a problem with the error message itself, access to that file should be blocked.
However I ask myself what is triggering these requests and why?
I assume that the HTTP request is done by the shop itself, maybe some kind of check. One indication of that could be the fact that no referrer (sic!) and no user-agent is provided with the request - so not from the standard browser.