Shouldn't .md files be denied?

[joho1968]

Shouldn't access to .md files be denied, considering the CHANGELOG.md file contains (possibly) sensitive version information?

[AJMaxwell]

In addition to .md files, various image, css, and js files from plugins and other locations are also publicly available. I don't think it's a major security vulnerability, it can be used to learn if a Matomo installation is running potentially exploitable plugins.