include files should use defined('MOODLE_INTERNAL') || die();

[danmarsden]

if a php file should not be loaded on it's own (class files etc) then you should be adding a check to:
defined('MOODLE_INTERNAL') || die();

at the top of the file.

This is really important for the files in your /view directory -

[JaneAdelmann]

Fixed in version v2.1