Why not put the file(s) in a directory relative to your application context?
Put the directory below WEB-INF/ and it is only accessible to your code, and
via a relative path at that.

-- Lew

I'm not sure how well this will work with what you are doing, but you
could always create the file, as you are, and stream it back to the
user in the response, maybe using a generic servlet. A sloppy-quick
sample:

<code>

//get the file from disk, or use one you've created
File file  = new File(file_you_created);
if(file.exist())
{
 //HttpServletResponse
 response.reset();
 response.setContentType("text/plain");

 //set the header, I think it's response.setHeader(foo,bar,etc)

 //stream it out
 byte[] buf = new byte[1 * 1024];
 int nRead = 0;
 FileInputStream fis = new FileInputStream(file);
 while ((nRead = fis.read(buf)) != -1) {
  response.getOutputStream().write(buf, 0, nRead);
 }

 //keep it clean
 fis.close()
 response.getOutputStream().flush();
 response.getOutputStream().close();
}

</code>

or something like that...

Hope that helps,
Nate.