Angular assets folder exposes internal files as public URLs — choosing what belongs in the build output
I'm designing an Angular workspace (current CLI, standalone app) and need to settle how static files are published. My understanding is that anything listed under the assets array in angular.json is copied verbatim into the output directory and served at a predictable public URL, with no framework-level access control. That makes it easy to accidentally ship