You need not only security but also to use a framework in a good way.
This is far from the usual way:
use Phalcon\Mvc\Application;
session_start();
define("BASE_PATH", dirname(__DIR__));
define("APP_PATH", BASE_PATH . "/app");
define("PATH_BASE", realpath(__DIR__ . '/..'));
define('DEV_MODE', ($_SERVER['REMOTE_ADDR'] == '::1' ? true: false));
but indeed deal with security 1st.