Fix the directory for the configuration
Protect the endpoint

protect it by not allowing arbitrary URIs from being scanned.