Rails serving files outside assets folder and public folder

Rails version: Rails 3.2.15

Ruby version: ruby 1.9.3p551 (2014-11-13 revision 48407)

Issue:

My rails app in development mode is serving files from storage folder which is at root level. The file format is pdf and mp4.

By serving i mean if I hit the route directly Eg: http://localhost:3000/assets/file_name.pdf is not throwing error and instead is opening on the browser.

I want to put these files behind authentication and hence tried putting it outside app/assets and public/ folders.

I'm not sure why is it able to serve any file outside those directories. Here are few of my configs for reference:

config.assets.enabled = true

config.assets.compress = false

config.assets.debug = true

Please help...