config.yml is public (weird?)

[alexabruck]

It just struck me that config.yml is publicly accessible, e.g. in an Astro project it would be inside the /public folder.
I understand that the config.yml does/should not contain any security sensitive data (e.g. access tokens), but rather "just" the content model.

But is the content model something that you consider public data?
A content model could contain hints about internal business logic, e.g. pricing tiers or discount logic (e.g. a collection named tiered_pricing_rules, an internal taxonomy, a workflow approval structures (e.g. a field named requires_legal_review). Things I don't really want to share with the public.

What's your take on that?

[FlxRobole]

Hey there :) The fact that Decap's configuration is "exposed" to the public was quite striking for me when I installed it the first time.

I managed to solve this by moving Decap (i.e. the /public directory) to a separate Gitlab/Github repository. That repository contains ONLY the index.html and config.yml files and outputs that files 1:1 to a Gitlab/Github page. That page - here comes the trick - is protected by Gitlab Pages Access Control so it can ONLY be accessed by authenticated Gitlab users (Github should provide the same feature under a similar name).

You can come up with a different solution, but the key takeaway is that Decap may not have to live side-by-side with your main application as long as it can access the repository that contains the content.