logto-tunnel serves files outside --experience-path via path traversal
@logto/tunnel serves custom sign-in experience files from the –experience-path directory. When the tunnel service is reachable, a requester can use ../ path segments in a static asset request to read files outside that directory that the CLI process can read.