If you add a private files directory after installing Drupal 8.0.3, you will get a warning on the status page saying it is not fully protected and to see https://www.drupal.org/SA-CORE-2013-003 for information about how to protect it with an .htaccess file. The message shows up even if the directory is not Web-accessible. Ignore it. The .htaccess file will be created automatically after caches are rebuilt.
What I’m Learning