expose files only in /app folder