don't expose external files