Yeah actually I forgot Lucee doesn't do the autogen docs CF does. As it's just a dump, probably makes sense to count it as debug.
That said, if a file is web accessible, then sure they intent is for it to... erm...
be web accessible..?
I guess this is a sorta guards against all those twerps who have
all their source code in a web accessible dir.
https://luceeserver.atlassian.net/browse/LDEV-4208 raised.