One folder

Open app View repo

Write the allowed path as notes/ only.

A request for ../secrets fails the check.

The trace stores the denial.

No file outside notes/ is read in the story.

Sources and go deeper

sources.json