Qwik City Vite public folder hidden files exposure question

Qwik City + Vite: Should hidden files in public/ be served by default?

0 reputation · 25 Mar 2021, 09:50 UTC

141.2K views0

When using Qwik City with its default Vite setup, the public/ directory is exposed as the static asset root for both development and preview servers. The framework does not currently state whether hidden files such as .env or .gitignore should be automatically blocked from being served, leaving the decision to individual projects.

This ambiguity creates a potential security gap if developers inadvertently place sensitive files inside public/, relying on the assumption that they are not reachable.

What is the intended default behavior for hidden files in the public/ folder, and should Qwik City provide a built‑in mechanism to prevent their exposure?

656 following

Keep exploring this topic

Vite HMR under many concurrent clients: tune server.hmr.interval or accept default batching?

Choosing between lowering server.hmr.interval and keeping default HMR batching when many concurrent clients trigger simultaneous hot-module updates on a Vite dev server.

Vite chunkSizeWarningLimit: raising the warning threshold versus code-splitting the chunk

Vite's chunkSizeWarningLimit only controls when the 500 kB warning prints; it does not fail the build or change output. When is raising the limit justified versus code-splitting, and how can a chunk size budget be enforced in CI?

Qwik City routeLoader$ data and qwik-react islands: shared state serialization limits

Exploring state sharing between Qwik City routeLoader$ and qwik-react islands under resumability constraints.

SSR responses stall under concurrent load in a Qwik app using routeLoader$

A Qwik 1.x design question: does streamed SSR stalling under concurrent requests reflect documented framework behavior or server saturation, and how do routeLoader$ timing, serialized state size, and lazy chunk prefetching each contribute?

Qwik City + Vite: Should hidden files in public/ be served by default?

0 answers

Your perspective belongs here.

0 question comments