If you're running malicious code it doesn't matter which directory you're running it from. And I hope noone is using http.server to deploy their python webapps

If you're running malicious code it doesn't matter which directory you're running it from. And I hope noone is using http.server to deploy their python webapps. the documentation even has a warning right at the top https://docs.python.org/3/library/http.server.html https://docs.python.org/3/library/http.server.html