StayPresent Static File Serving: Key Security Risks and Protections Explained

StayPresent's web.html() and web.markdown() functions serve all files in a target directory, not just the ones explicitly linked, which can inadvertently expose sensitive files like .env or source code to anyone who requests them by name. The library does include built-in path traversal protection, preventing requests from escaping the designated directory to access files elsewhere on the filesystem. For Markdown rendering, HTML characters are escaped by default, and only a limited set of approved block-level HTML tags are passed through unescaped. URL scheme filtering in web.markdown() blocks dangerous destinations such as javascript:, vbscript:, and file: links, while data: URIs are permitted for images but rejected for hyperlinks. The recommended safeguard is strict directory hygiene — isolating only publicly safe assets into the folder passed to these functions and keeping credentials or config files in separate directories entirely.