I'm currently trying to make an old PHP web application a little bit more secure. Currently, the apache setup is such that all of the application's class files are available for user access (although indexes are turned off). Browsing to them just gives a blank page, since they don't have any output and aren't even initializing any objects, just declaring classes.
Is this a security issue, and how large of one? My gut feeling is that it's a terrible idea, but other than giving an attacker information into the server setup I don't have any particular reason to think so.