This folder is where send.php writes what comes in.

  briefs-YYYY-MM.csv     every brief, one file per month. Open it in Excel
                         or Google Sheets.
  trapped-YYYY-MM.csv    submissions the spam traps stopped. Check it now and
                         then to make sure a real person has not been caught.
  mail-failures.log      written only when a brief saved but the email did
                         not go out. An empty or missing file is good news.
  rate.json              counts recent submissions so one visitor cannot send
                         hundreds. Addresses are stored hashed, not in full.

KEEP THIS FOLDER PRIVATE

The .htaccess file beside this one blocks web access on Apache, which is what
most shared hosting runs. If your host uses nginx instead, .htaccess is
ignored, so do one of these two things:

  1. Move this folder above your web root and point $LOG_DIR in fillup.php at
     the new location. This is the better answer.
  2. Add a deny rule for /storage/ to your nginx site config.

Either way, after your site is live, type the address of one of the CSV files
into a browser. You want "403 Forbidden" or "404 Not Found". If the file
downloads, your clients' names, budgets and event dates are public and you
should fix it before doing anything else.

PERMISSIONS

PHP has to be able to write here. If nothing appears after a test brief, set
the folder to 755, or 775 if your host needs it. send.php creates the folder
by itself if it is missing.
