There are lots of web apps that use update mechanisms like this one. Back in the bad old days, I remember writing something that synced code files by using some

There are lots of web apps that use update mechanisms like this one. Back in the bad old days, I remember writing something that synced code files by using some convoluted homebrew json protocol. Anyway, the point is: this kind of functionality is normally restricted by the web app, usually requiring admin privileges or some form of authentication. For example, at work, we have a similar function that pulls down the current SVN repository onto the web servers. We've been doing this for years, it works great - but that doesn't mean people can just call these URLs from the outside. I also believe choosing an obfuscating name for the update file is not sufficiently secure.