The Folder Your Bot's Dashboard Might Be Quietly Handing Out

A convenient default that serves an entire folder can also serve files you never meant to share. Here's the one-line fix.

The Folder Your Bot's Dashboard Might Be Quietly Handing Out

Quick question, if you've ever built a simple HTML status page or dashboard for your bot: what else is sitting in the same folder as that HTML file? If the honest answer includes a .env, a config file, or anything with a secret in it, it's worth reading the next three minutes carefully.

Convenience has a cost, and it's usually invisible

Serving a webpage with a stylesheet and a script next to it "just working," with no extra configuration, feels like a small miracle the first time you see it happen — link a CSS file, it loads, no setup required. What that convenience is quietly doing under the hood is serving everything in that folder, not just the file you meant to share. Your style.css loads because everything next to your HTML file loads. Including, potentially, things that were never supposed to be public.

Nobody notices until it matters

This isn't a hypothetical — it's an extremely easy mistake to make precisely because nothing about it looks wrong. Your dashboard loads correctly. Your styling works. Everything appears fine, right up until someone realizes they can just... request .env directly, by name, and get it handed back to them.

The fix is one keyword

staypresent.web.html(
    "templates/dashboard.html",
    exclude=[".env", ".git", "*.py", "secrets.json"],
)

That's the entire fix. Anything matching those patterns now returns a clean 404 instead of its actual contents — no matter which route happens to be serving that folder, and no matter how deeply nested the matching file is.

Worth doing even if you "probably don't have anything sensitive there"

The honest, slightly uncomfortable truth is that most people don't actually check what's sitting next to their dashboard's HTML file — a project gets thrown together quickly, a template folder ends up next to a config file almost by accident, and nobody goes back to verify what's technically reachable. exclude costs one line. Checking your folder by hand costs the ten minutes you were going to spend not thinking about it.

Trust is built on the boring stuff

Nobody's going to compliment you for adding exclude to your dashboard setup. But it's exactly the kind of unglamorous, thirty-second fix that separates a project that quietly handles things correctly from one that gets a very bad surprise someday. Do the boring thing now.

pip install --upgrade "staypresent[prod]"

Check what's in that folder. Then add the one line.