fix(includeBytes): additional documentation and test for particulars …

documentation/docs/experimental/includeBytes.mdx

@@ -10,6 +10,8 @@ The **`includeBytes()`** function is used embed a file as a Uint8Array.
 
 >**Note**: Can only be used during build-time initialization, not when processing requests.
 
+>**SECURITY**: `includeBytes()` is fully sandboxed to prevent access to files outside the directory that contains `fastly.toml`. All other files within that scope will be accessible, including through `..` and symlink navigation, including potentially sensitive files such as `.env`.
+
 ## Syntax
 
 ```js

integration-tests/js-compute/.hidden.txt

@@ -0,0 +1 @@
+this is for the includeBytes sandbox test

integration-tests/js-compute/fixtures/app/.hidden.txt

@@ -0,0 +1 @@
+idk

integration-tests/js-compute/fixtures/app/src/include-bytes.js

@@ -17,11 +17,31 @@ routes.set('/includeBytes', () => {
 });
 
 let nope = null;
+let dotfileNotOk = null;
+let dotfileOk = null;
 
 try {
   nope = includeBytes('../../../../README.md');
 } catch {}
 
+try {
+  dotfileOk = includeBytes('./.hidden.txt');
+} catch {}
+
+try {
+  dotfileNotOk = includeBytes('../../.hidden.txt');
+} catch {}
+
 routes.set('/includeBytes/sandbox', () => {
   assert(nope, null, 'includeBytes sandboxes its path to the project dir');
+  assert(
+    dotfileNotOk,
+    null,
+    'includeBytes sandboxes its path to the project dir',
+  );
+  assert(
+    Array.from(dotfileOk),
+    [105, 100, 107, 10],
+    'dotfile is included just fine',
+  );
 });