Vite publicDir copy bypasses access control, exposing arbitrary files during dev and build

Vite’s publicDir feature serves files from the designated directory unchanged during development and copies them verbatim to the build output root, making every file publicly addressable without any transformation or access control.

No built‑in validation warns when files matching common secret patterns such as .env*, .pem, id_rsa or .key reside in publicDir, and the copy step performed by fs‑extra after the Rollup bundle cannot be intercepted by plugins that hook writeBundle, which runs after the copy.

Should Vite introduce default deny‑list checks for typical secret file extensions? Can plugins reliably filter files before the public copy occurs? How can developers ensure sensitive assets are excluded from public exposure?