Spring-boot web and public resources

Question

From my understanding, ONLY the files located in the folders:

src/main/resources/public
src/main/resources/static

are served statically by the web server.

So if these two files contain sensitive configurations, are they safe in this location (not exposed by the web server) ?

src/main/resources/ultra_secret.xml 
src/main/resources/nasa/alien_list.xml

Answer 1

ONLY the files located in the folders:

No. The list is here.

are they safe in this location (not exposed by the web server) ?

By a process of elimination, yes.