Normally, the file debug.log is included in the folder wp-content, and everybody can read it at https://your-domain.com/wp-content/debug.log/
You can change the location of the debug.log file adding these lines of code in your wp-config.php:
ini_set( 'log_errors', 1 ); ini_set( 'error_log','[path-to-main-directory]i//debug-jk3e8371.log' );
Replace [path-to-main-directory] with the path to the directory where WordPress is installed.
If you have somewhere the constant WP_DEBUG in your wp-config.php, delete or comment on the line of code where you see it.
That’s it. Then your log file will be debug-jk3e8371.log,, it will be located in the main folder, but only those who know the name will be able to read it.
Of course, replace the name debug-jk3e8371 with whatever you like, better avoiding easy names.
If you prefer it, you can install the plugin Change Debug Log Location. You can find it on the official WordPress repository.