Bug

The path traversal check uses a simple Contains("..")):

if (path.Contains("..")) // no directory traversal

This blocks legitimate paths that contain .. as part of a folder or file name, e.g. C:\folder..name\file.txt or C:\my..app\config.json.

Suggested fix

Check for .. only as a path segment using Path.GetFullPath() and comparing with an expected base path, or check for \.. / /.. patterns specifically:

var fullPath = Path.GetFullPath(path);
if (fullPath != path && path.Contains(".." + Path.DirectorySeparatorChar))

File

src/Servy.Core/Helpers/Helper.cs — line 28