Default static directory vs. justpy.env file location

According to the docs, the justpy.env file should be in the directory from which the program is run. The default static directory however is the same folder:

STATIC_DIRECTORY = config('STATIC_DIRECTORY', cast=str, default=os.getcwd())

This means, by the default, the justpy.env (possibly containing sensitive information) can be reached at http://localhost:8000/static/justpy.env

Isn’t this a security flaw? Might be better to change the default to the module directory as with the templates:

STATIC_DIRECTORY = config('STATIC_DIRECTORY', cast=str, default=f'current_dir + '/static')

And include the default JustPy favicon there as well? So the favicon also works in the NO_INTERNET scenario.

[platinops]

Thanks for the feedback. Even with a solution in place, might be useful to mention in the docs not to use the working dir as a static folder…

[WolfgangFahl]

move papillon.jpg when explaining the move of static content