Deny /app/private to public.