This file must not be readable from an HTTP request