After finding a few issues with moving the vendor directory, I decided to revert that change (removing an environment variable). With that change moving things back into the publicly accessible site it was necessary to implement a url rewrite rule to reject any requests to the vendor directory for security purposes.