Vite dev server access control can be bypassed: files blocked by server.fs.deny (e.g., .env, *.crt) are still served with HTTP 200 when requests append ?raw, ?import&raw, or ?import&url&inline. Affects: vite >= 7.1.0, < 7.3.2 and >= 8.0.0, < 8.0.5, plus vite-plus < 0.1.16. Upgrade to 7.3.2 or 8.0.5 (or vite-plus 0.1.16+) to mitigate.