security fix, only files in app/public can be accessed