public/ is world-readable via the Cloudflare tunnel (GitHub-embeddable). NEVER put secrets/backups here. private/ is 403 until Phase 2 (Cloudflare Access).