[security] is it safe just by putting index.php / index.html

[EoF]

As long as an index file exists, there is no way to directory list.

I don't know if it is necessarily true. As long as there is an index file you can not browse the directory with a browser! I think it's possible to write a program (for instance in Visual C using InternetFindNextFile()) to browse a directory.
Now, if anyone tried to browse your directory they'd get that "<h1>Sorry You cannot browse this directory</h1>" message so they'll know there's something there and might be determined to find out what it is through the above mentioned way. What I would do is replace the message with a standard page unavailable message, or better, redirect to the error 400 page. Hope this makes sense!