diff --git a/server/render.js b/server/render.js
index <HASH>..<HASH> 100644
--- a/server/render.js
+++ b/server/render.js
@@ -182,6 +182,12 @@ export async function serveStaticWithGzip (req, res, path) {
 export function serveStatic (req, res, path) {
   return new Promise((resolve, reject) => {
     send(req, path)
+    .on('directory', () => {
+      // We don't allow directories to be read.
+      const err = new Error('No directory access')
+      err.code = 'ENOENT'
+      reject(err)
+    })
     .on('error', reject)
     .pipe(res)
     .on('finish', resolve)
Disallow directories in /static (#<I>)