That's certainly the real problem here, the point is you might expect the webserver to prevent indexing but this file can act as an index.