如何从composer包中访问文件而不暴露文件供应商文件路径

I'm working on a file handler library which is use via composer packages. One of the features which i wanted to do is when a user click on any image or file link i want them to force download.

Example:

In index.php i have a img,pdf,xls. etc., files which linked to file path. Path to the image is relative path Before Encryption:

<a href="E:/MyData/Folder/example.jpg">Image download</a>

After excryption:

<a href="http://www.application/vendor/composer-package/src/package-name/download.php?file=encrypted-file-name.jpg">Image download</a>

For some reason we should only write to this directory which is not accessable on browser for security reasons. But php can read this file and get downloaded. So i have a library which takes the excrypted file path like above. Now how can we use download.php without exposing vendor path to download file.