That doesn't mean you should allow your app to access `file://` ... (Nor allow it out of a chroot.) Simply knowing some usernames on your system could provide

That doesn't mean you should allow your app to access `file://` ... (Nor allow it out of a chroot.) Simply knowing some usernames on your system could provide an attacker with clues...