Secured [critical?] files.

I've saw that the files inside bin/ directory are not secured.
So, i can see the whole content of setzadmin, setso and zppy.
So, since the unique thing here which will be accessed remotely is the api.php, just this file should be accessible.