Avoiding Accidental Public Exposure of Files in Gatsby's Static Directory

Problem Statement

When a file is placed in a Gatsby project’s static folder, the build process copies it verbatim into the public directory. This guarantees that any such file is reachable at http://site.com/filename once the site is served, regardless of its content or intended audience.

Current Constraints

The Gatsby documentation specifies that static is a public asset bucket; there is no documented flag or configuration option to mark individual files as private or to prevent their copy to public. Environment variables can influence rendering logic, but they do not alter the copying step. Plugins that process images from static likewise output to public, maintaining the same exposure.

Unresolved Decision

Because the static folder’s behavior is hard‑coded, developers must manually keep sensitive assets outside of static or serve them through alternative mechanisms. No official API currently exists to express privacy intent for static files.

Specific Questions

1. Does Gatsby provide any undocumented or experimental configuration to prevent specific files in static from being copied to public?
2. Will upcoming Gatsby releases introduce a privacy flag or similar option for static assets?
3. What are the best‑practice patterns for keeping confidential files out of the static directory while still enabling build‑time processing?