Denying access to non-public files inside webui directory

[Ultranium]

I'd like to know if there is a way to stop files like package.json in the webui folder from being served to user.

The sample application with Quinoa from https://code.quarkus.io/ generator allows access to the package.json, vite.config.js and some files, which, is my opinion, is a big no-no from the security standpoint.

I can block them with quarkus.http.auth.permission.* config properties, but I just want to make sure I'm not doing something stupid and maybe there is a more suitable option to do this at Quinoa level.

[Ultranium]

OK, I just found out that this behavior is only observed in Dev mode. Trying to retrieve package.json in Production mode returns 404 as it should.