Document security of serve_dir router
@@ -118,6 +118,12 @@ impl<'a, State: Clone + Send + Sync + 'static> Route<'a, State> {
/// Each file will be streamed from disk, and a mime type will be determined
/// based on magic bytes.
///
+ /// # Security
+ ///
+ /// This handler ensures no folders outside the requested folder can be served,
+ /// and attempts to access such files will return StatusCode::Forbidden to the
+ /// caller
+ ///
/// # Examples
///
/// Serve the contents of the local directory `./public/images/*` from
