With the browser, we can download the files in the sqlpage folder. For example, it's possible to read the sqlpage.json configuration file. It's a security problem. The sqlpage folder must be keep hidden.
It's possible to set rewrite rules on the proxy side to block the download. But, I think that it will be cool to filter url in sqlpage server.