Prevent URL access to the "app" directory in Symfony 3.3

I have been with Symfony for a short time and I am developing an application.

Everything works perfectly but I realized that I can access the configuration files located in "app / config" just by putting the path in the browser (for example, putting link ).

In the "security.yml" itself, I have access control defined by users in this way:

firewalls:
    dev:
        pattern: ^/(_(profiler|wdt)|css|images|js)/
        security: false

    main:
        anonymous: ~
        provider: our_db_provider
        form_login:
            login_path: /login
            check_path: /login_check
            default_target_path: /panel
            target_path_parameter: /panel
        logout:
            path: /logout
            target: /login

access_control:
        - { path: ^/langAdmin, roles: ROLE_ADMIN, requires_channel: https }
        - { path: ^/config, roles: ROLE_ADMIN, requires_channel: https }
        - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY, requires_channel: https }
        - { path: ^/$, roles: IS_AUTHENTICATED_ANONYMOUSLY, requires_channel: https }
        - { path: ^/, roles: IS_AUTHENTICATED_FULLY, requires_channel: https }

All this works. It does not allow unregistered users to enter, and in the defined zones that start with "langAdmin" and "config" it only lets administrators enter.

I have tried both in DEV environment and in PROD environment and the same thing happens.

How can I protect the files located inside "app"?

Thank you.