this file must not be readable by a worker created with read: false