Support

I assume that by "module" you don't actually mean a Joomla! module because these render inside Joomla! and are most definitely not JSON files.

Are you asking me if you can allow direct access to a static .json file? If so, yes, it's safe.

Are you asking me if you can allow direct access to a .php file which generates JSON output? No, I CAN NOT guarantee it's safe. This is the whole point of me saying that you shouldn't allow direct access to arbitrary .php files, no matter what they do, whether they return output and if they do return output what format that comes in. This is irrelevant. The only thing relevant is HOW that file works under the hood. Since it runs outside Joomla! we know that a. all the automatic protections built into Joomla! over the last 15 years will NOT be applied b. all the automatic protections offered by Admin Tools will NOT be applied and c. it's up to its developer to make sure everything is being handled securely. The latter is not a given. Many years ago millions of WordPress (and other) sites were hacked because an image thumbnail script called TimThumb has a security flaw and developers using it never bothered to update it. None of them thought a small script that resizes images would be important, yet millions of hacked sites later these people were forced to take security more seriously.

As a rule of thumb, allowing direct access to static content is fine. Direct access to dynamic content (i.e. .php files in most cases) is NOT safe. If you need dynamic content go through a Joomla! component, written by someone who follows Joomla! standards and best practices, to minimize the risk. If you cannot do that, audit the dynamic code. Anything else includes an unknown risk, much like driving around without a seat belt or smoking: it's not necessary you'll get harmed but the odds are against you - and the kind of harm you'd be subjected to in this case is substantial.

Yes, as long as it's a static .json file you can safely allow it. A static .json file doesn't have any logic, it doesn't "do" anything on your server. Therefore it cannot be used to hack your site.

If it's not a .php file it's not dynamic, hence it's static.

You're welcome!