FileAttachment within the .observable subfolder works in preview but not in Notebook Desktop

[ltostes]

When trying to import a file within the .observable subfolder of the project, Notebook Desktop isn't able to read it. It does work, however, when using preview. Is this intended?

I was initially using this subfolder to centralize database definitions and files I don't want to upload to Git. I understand there is an easy workaround solution, but I was curious if this kind of use of the folder should be discouraged or not.

[ltostes]

Just found another interesting behavior. When using a symlink to files outside this project (macOS), the opposite happens: File attachment works fine in Notebook Desktop, but not in preview:

(also, the console outputs a vite error)

(the original folder in this case holds the file to which symlink is pointing to)

I tested building it and statically serving .observable/dist and it worked fine.

Is this expected?

[mbostock]

We intentionally disallow FileAttachment access to the .observable directory as a security safeguard. The .observable folder is where credentials are stored for databases (databases.json); since you might be pulling in third party code in your notebook, it feels like a good idea to have some protection around access to credentials. If you want to access files from your notebook, you should put them in a different directory.

(We haven’t yet implemented these safeguards in Notebook Kit directly, but we should.)