In reply to Konstantin Kovshenin.

A few things about the security here...

1. This plugin is for use on a dev site, which shouldn't be publicly accessible anyways
2. We add a salt to the default filename making it hard to guess
3. The file path is the first option on the settings screen and can easily be adjusted

The chances that PHP has write permission to the uploads folder is very good, so that's why a lot of plugins use that location. However, this is a plugin for developers, so I'm open to the idea of changing the default path to be a non-public location, but how do you detect a non-public folder? Maybe the better course would be to not have a default and force them to choose a path?