should not be in public-resources, i.e. accessible from web