Avoid permissive settings when using `external-path`, like `'.'`.

Prefer `external-files-path` or use specific folders:

```xml
<?xml version="1.0" encoding="utf-8"?>
<paths>
    <external-path
        name="downloads"
        path="Download/" />
</paths>
```
