Source Code and Config Leaks

A web server can expose source code and configuration simply because its static-file boundary is too broad. Imagine a Go app that serves the entire working directory:

fileServer := http.FileServer(http.Dir("."))
mux.Handle("GET /", fileServer)

That might make /web/public/logo.png available, but it can also expose /go.mod, application source, and other project files.

Serve a deliberately curated directory instead:

publicFiles := http.FileServer(http.Dir("web/public"))
mux.Handle("GET /", publicFiles)

A URL prefix does not narrow the filesystem root by itself. Mounting the first handler under /assets/ would still publish files from .; it would only change the URLs used to reach them.