It's intended to join untrusted path components but actually used for joining configuartion paths, which are trusted. `safe_join(settings.STATIC_ASSETS_PATH, "index.html")`