Qwik City + Vite: Should hidden files in public/ be served by default?

No, Qwik City does not serve hidden files (files starting with a dot) from the public/ directory by default.

Because Qwik City relies on Vite for static asset handling, it inherits Vite's default security posture. Vite's development and preview servers explicitly filter out files like .env, .gitignore, or .htaccess when located in the public folder to prevent accidental exposure of sensitive configuration or metadata.

How the behavior works

The exclusion is handled by Vite's internal middleware. When a request is made for a file located in the static asset root, Vite checks the filename. If the filename begins with a period, the server typically returns a 404 Not Found rather than serving the file content. This is a core Vite feature, rather than a specific Qwik City implementation.

Security Recommendations

• Never store secrets in public/: Even The public/ directory is intended for public assets (images, fonts, manifest files). Sensitive environment variables should reside in the root-level .env and be accessed via import.meta.env in server-side code or build steps.
• Use explicit subdirectories: If you need a configuration file to be publicly accessible, rename it to remove the leading dot (e.g., config.json).
• Audit your Vite config: Ensure your vite.config.ts does not have custom publicDir settings or plugins that explicitly bypass default file filtering.

Verification Steps

To verify this behavior in your specific Qwik City project, run the following test:

1. Create a dummy hidden file: touch public/.secret-test
2. Start your development server: npm run dev
3. Attempt to access the file in your browser at: http://localhost:5173/.secret-test
4. Expected Result: You should receive a 404 error.
n