diff --git a/.claude/settings.local.json b/.claude/settings.local.json
index 246cf5e..2a9518e 100644
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -12,7 +12,8 @@
       "Bash(npx vue-tsc *)",
       "Bash(npx vite *)",
       "Bash(xargs ls -la)",
-      "Bash(xargs ls)"
+      "Bash(xargs ls)",
+      "WebFetch(domain:teletypegames.org)"
     ]
   }
 }
diff --git a/apps/api/app/controllers/files_controller.rb b/apps/api/app/controllers/files_controller.rb
index 5c75c98..611e048 100644
--- a/apps/api/app/controllers/files_controller.rb
+++ b/apps/api/app/controllers/files_controller.rb
@@ -1,16 +1,19 @@
 class FilesController < ApplicationController
+  skip_forgery_protection
+
+  BASE_PATH = Pathname.new(ENV.fetch("FILE_CONTAINER_PATH", "/softwares")).realpath
   def show
-    base = Pathname.new(ENV.fetch("FILE_CONTAINER_PATH", "/softwares")).realpath
-    full = base.join(params[:path])
+    requested = params[:path].to_s
+    full_path = BASE_PATH.join(requested)
 
-    return render plain: "Not Found", status: :not_found unless full.to_s.start_with?(base.to_s)
+    if File.directory?(full_path)
+      full_path = full_path.join('index.html')
+    end
 
-    full = full.join("index.html") if full.exist? && full.directory?
-
-    return render plain: "Not Found", status: :not_found unless full.exist? && full.file?
-
-    send_file full.to_s, disposition: "inline"
-  rescue Errno::ENOENT
-    render plain: "Not Found", status: :not_found
+    if File.file?(full_path)
+      send_file full_path, disposition: 'inline'
+    else
+      head :not_found
+    end  
   end
 end
diff --git a/apps/api/config/routes.rb b/apps/api/config/routes.rb
index d3fab11..c05771b 100644
--- a/apps/api/config/routes.rb
+++ b/apps/api/config/routes.rb
@@ -11,5 +11,5 @@ Rails.application.routes.draw do
   end
 
   get "update",       to: "update#update"
-  get "file/*path",   to: "files#show", format: false
+  get "file(/*path)",   to: "files#show", format: false
 end