diff --git a/modules/yamlform_ui/src/Form/YamlFormUiElementTestForm.php b/modules/yamlform_ui/src/Form/YamlFormUiElementTestForm.php
index a71e099..07702d0 100644
--- a/modules/yamlform_ui/src/Form/YamlFormUiElementTestForm.php
+++ b/modules/yamlform_ui/src/Form/YamlFormUiElementTestForm.php
@@ -108,6 +108,17 @@ class YamlFormUiElementTestForm extends YamlFormUiElementFormBase {
           '#code' => Yaml::encode($test_element),
         ],
       ];
+
+      $form['test']['render_array'] = [
+        '#type' => 'details',
+        '#title' => $this->t('Render array'),
+        '#desciption' => $this->t("Below is the element's final render array."),
+        'source' => [
+          '#theme' => 'yamlform_codemirror',
+          '#type' => 'yaml',
+          '#code' => Yaml::encode($this->element),
+        ],
+      ];
     }
 
     $form['key'] = [
diff --git a/src/Plugin/YamlFormElement/ManagedFile.php b/src/Plugin/YamlFormElement/ManagedFile.php
index a4a0024..d1b47b5 100644
--- a/src/Plugin/YamlFormElement/ManagedFile.php
+++ b/src/Plugin/YamlFormElement/ManagedFile.php
@@ -70,6 +70,8 @@ class ManagedFile extends YamlFormElementBase {
     if (!parent::isEnabled()) {
       return FALSE;
     }
+
+    // Disable managed file element is there are no visible stream wrappers.
     $scheme_options = self::getVisibleStreamWrappers();
     return (empty($scheme_options)) ? FALSE : TRUE;
   }
@@ -77,8 +79,23 @@ class ManagedFile extends YamlFormElementBase {
   /**
    * {@inheritdoc}
    */
+  public function displayDisabledWarning(array $element) {
+    parent::displayDisabledWarning($element);
+
+    // If there are not visible stream wrappers encourage the site administrator
+    // to enable private file uploads.
+    $scheme_options = self::getVisibleStreamWrappers();
+    if (empty($scheme_options) && $this->currentUser->hasPermission('administer yamlform')) {
+      drupal_set_message($this->t('Private file system is not set. This must be changed in <a href="https://www.drupal.org/documentation/modules/file">settings.php</a>. For more information see: <a href="https://www.drupal.org/psa-2016-003">DRUPAL-PSA-2016-003</a>'), 'warning');
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
   public function prepare(array &$element, YamlFormSubmissionInterface $yamlform_submission) {
     parent::prepare($element, $yamlform_submission);
+
     $element['#upload_location'] = $this->getUploadLocation($element, $yamlform_submission->getYamlForm());
     $element['#upload_validators']['file_validate_size'] = [$this->getMaxFileSize($element)];
     $element['#upload_validators']['file_validate_extensions'] = [$this->getFileExtensions($element)];
@@ -97,13 +114,6 @@ class ManagedFile extends YamlFormElementBase {
       return;
     }
 
-    // Issue #2817535 by jrockowitz: Drupal file upload by anonymous or
-    // untrusted users into public file systems -- PSA-2016-003.
-    $stream_wrappers = self::getVisibleStreamWrappers();
-    if (!isset($element['#uri_scheme']) && isset($stream_wrappers['private'])) {
-      $element['#uri_scheme'] = 'private';
-    }
-
     $container = [
       '#prefix' => $element['#prefix'],
       '#suffix' => $element['#suffix'],
@@ -312,7 +322,7 @@ class ManagedFile extends YamlFormElementBase {
     }
 
     // Remove the empty directory.
-    file_unmanaged_delete_recursive($this->getUrlScheme($element) . '://yamlform/' . $yamlform->id() . '/' . $yamlform_submission->id());
+    file_unmanaged_delete_recursive($this->getUriScheme($element) . '://yamlform/' . $yamlform->id() . '/' . $yamlform_submission->id());
   }
 
   /**
@@ -396,7 +406,7 @@ class ManagedFile extends YamlFormElementBase {
    */
   protected function getUploadLocation(array $element, YamlFormInterface $yamlform) {
     if (empty($element['#upload_location'])) {
-      $upload_location = $this->getUrlScheme($element) . '://yamlform/' . $yamlform->id() . '/_sid_';
+      $upload_location = $this->getUriScheme($element) . '://yamlform/' . $yamlform->id() . '/_sid_';
     }
     else {
       $upload_location = $element['#upload_location'];
@@ -411,14 +421,21 @@ class ManagedFile extends YamlFormElementBase {
   /**
    * Get file upload URI scheme.
    *
+   * Defaults to private file uploads.
+   *
+   * Drupal file upload by anonymous or untrusted users into public file systems
+   * -- PSA-2016-003.
+   *
    * @param array $element
    *   An element.
    *
    * @return string
    *   File upload URI scheme.
+   *
+   * @see https://www.drupal.org/psa-2016-003
    */
-  protected function getUrlScheme(array $element) {
-    return (isset($element['#uri_scheme'])) ? $element['#uri_scheme'] : 'public';
+  protected function getUriScheme(array $element) {
+    return (isset($element['#uri_scheme'])) ? $element['#uri_scheme'] : 'private';
   }
 
   /**
diff --git a/src/YamlFormElementBase.php b/src/YamlFormElementBase.php
index bd244d9..c9522cd 100644
--- a/src/YamlFormElementBase.php
+++ b/src/YamlFormElementBase.php
@@ -423,11 +423,10 @@ class YamlFormElementBase extends PluginBase implements YamlFormElementInterface
     }
   }
 
-
   /**
    * {@inheritdoc}
    */
-  public function displayDisabledWarning(array &$element) {
+  public function displayDisabledWarning(array $element) {
     $t_args = [
       '%title' => $this->getLabel($element),
       '%type' => $this->getPluginLabel(),
diff --git a/src/YamlFormElementInterface.php b/src/YamlFormElementInterface.php
index fe86c80..1f21e53 100644
--- a/src/YamlFormElementInterface.php
+++ b/src/YamlFormElementInterface.php
@@ -223,7 +223,7 @@ interface YamlFormElementInterface extends PluginInspectionInterface, PluginForm
    * @param array $element
    *   An element.
    */
-  public function displayDisabledWarning(array &$element);
+  public function displayDisabledWarning(array $element);
 
   /**
    * Set an element's default value using saved data.