Add some very basic request validation. - User try to find a file which is not located in his host directory - File is hidden or not
