process.cwd() - this is not safe 

what about __dirname?