test1/public/drupal-8.3.1/vendor/web.config

<configuration>
  <system.webServer>
    <authorization>
      <deny users="*">
    </authorization>
  </system.webServer>
</configuration>