I personally do the following and call it a day:
define("APP_ROOT", dirname(dirname(__FILE__)));
define("PRIVATE_PATH", APP_ROOT . "/private");
define("PUBLIC_PATH", APP_ROOT . "/public");
require_once PRIVATE_PATH . "/vendor/autoload.php";
require_once PRIVATE_PATH . "/security/security.php";
require_once PRIVATE_PATH . "/config/config.php";