Enable WordPress debug log to a private folder not accessible from the web. See http://wordpress.stackexchange.com/q/84132/24260 for details and motivations. NB: currently needs to be manually edited to specify the private folder path;

private-debug-log.php

<?php
/*
Plugin Name: Private Debug Log
Description: Enable debug log to a private folder not accessible from the web
Version: 0.0.1
Author: WebAware
Author URI: http://www.webaware.com.au/
*/

/*
copyright (c) 2013 WebAware Pty Ltd (email : rmckay@webaware.com.au)

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License, version 2, as
published by the Free Software Foundation.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
*/

/*
INSTRUCTIONS:
=============

Edit the location of $debuglog to specify a folder outside your website root, inaccessible to web browsers.
Some common folder names are 'private', '_private', 'tmp'
*/

// for testing, will put debug log in folder wp-content/uploads
//~ $debuglog = WP_CONTENT_DIR . '/uploads';

// put debug log in folder ../private (i.e. outside the web root)
$debuglog = dirname(ABSPATH)  . '/private';

ini_set('log_errors', 1);
ini_set('error_log', $debuglog . '/debug.log');

error_log(basename(__FILE__) . ': if you can read this, close enough.');