Move directory traversal back to public API