That's a great question. Although I don't encourage anybody to expose this to any network they don't trust, it was a concern. I was previously passing the incom

That's a great question. Although I don't encourage anybody to expose this to any network they don't trust, it was a concern. I was previously passing the incoming path directly to ServeFile[1] which handles this, although I have since put in a filepath.Clean... I've tested this in browsers and with curl and it looks okay, I'll take a closer look at this though. [1]: https://golang.org/pkg/net/http/#ServeFile https://golang.org/pkg/net/http/#ServeFile