our front-end code is served as a static file server on the /assets endpoint. though our none of our JS files are sensitive, there is no functional reason why we have directory support.

we should disable directory support to reduce security findings.