@greg_smalter, read Scott Hunter’s comment on this blog post: http://weblogs.asp.net/scottgu/introducing-asp-net-5. In web projects, they have completely segregated static files (which get automatically served) from code, razor views, and other server-side logic. The latter is placed in a separate folder that is outside of IIS’s scope. This should alleviate all of your concerns about accidentally serving code files containing sensitive info.
2 Likes