The list of steps to remove the public folder are documented at https://docs.flarum.org/install#customizing-paths
Once done, a scan on the Lab is indeed a good idea. It'll check for any misconfiguration.
If this is a new install, the easiest is to start again with the Zip download that doesn't have the public folder.
The critical part is that it should be impossible to access or execute any file in vendor or storage. If you install with Composer those folders are expected to be out of the webroot and don't have any special protection. The htaccess and nginx files have optional protection rules that can be un-commented for those not using the public folder, but those rules only work if the files in the public folder have been moved to the root. If an HTTP redirect to /public is properly implemented and handles every request that doesn't start with /public then there should be no security risk, but that's not how the software is supposed to be installed.
