I hadn't seen this before... At least it calls out how dangerous the .well-known directory could be. So that's good. /s 4.4. Hidden Capabilities Applications

I hadn't seen this before... At least it calls out how dangerous the .well-known directory could be. So that's good. /s 4.4. Hidden Capabilities Applications using well-known locations should consider that some server administrators might be unaware of their existence (especially on operating systems that hide directories whose names begin with "."). This means that if an attacker has write access to the .well-known directory, they would be able to control its contents, possibly without the administrator realising it.