You have a point that is not explained well by me! This was just in my situation.
Of course you can place security sensitive stuff outside the root/dist of your project but then the links should still work when they are spit out by the build system!
It doesn’t matter on what location you want the parts of your website to be. For security reason or whatever! You can create the build system the way you want and create the links the way you want. My example is just my example and comes from the official Get Bootstrap website and is used by millions of users around the world. It’s only a example not “the system” but what I use.
I just finished a multi lingual website with 4 languages in 4 separate folders including 3 index files in 3 folders and 1 welcome index file for all languages in the root and a small shopping page outside the root. My build system was set up in a way that it all worked out of the box. In Pinegrow and on a real server. except for the PHP functionality that only worked in MAMP or life.
Imagine that I had to change all the links of the 160 pages website all the time, because my build system had put or the links in wrong or the pages on the wrong location.
When the build system is wrongly set up you get broken links and pages in the wrong location, that’s what I tried to explain.
It has nothing to do with the criteria of Pinegrow. All my websites work in Pinegrow no matter what the folder structure is, on my local server (MAMP) and my life server. So Pinegrow works perfectly with any website (It’s I think based on Chromium). A build system has to produce a working website.
Example of payment page outside the root/dist made with the build system from my example seen in Pinegrow: