diff --git a/app/backend/http/handler.py b/app/backend/http/handler.py
index 59b3643..c95e484 100644
--- a/app/backend/http/handler.py
+++ b/app/backend/http/handler.py
@@ -104,6 +104,13 @@ class HttpTransportMixin:
         except ValueError:
             self.send_error(HTTPStatus.FORBIDDEN)
             return
+        if candidate.is_dir():
+            candidate = (candidate / "index.html").resolve()
+            try:
+                candidate.relative_to(STATIC_DIR.resolve())
+            except ValueError:
+                self.send_error(HTTPStatus.FORBIDDEN)
+                return
         if not candidate.is_file():
             candidate = STATIC_DIR / "index.html"
         try:
diff --git a/app/frontend/index.html b/app/frontend/index.html
index 6fa118f..2d85bfa 100644
--- a/app/frontend/index.html
+++ b/app/frontend/index.html
@@ -16,7 +16,7 @@
       const autoMobile = window.matchMedia && window.matchMedia("(max-width: 720px)").matches;
       const mobileUA = /Android|iPhone|iPad|iPod|Mobile|Windows Phone/i.test(navigator.userAgent || "");
       if (!forcedDesktop && !alreadyMobile && (forcedMobile || autoMobile || mobileUA)) {
-        window.location.replace("/m/index.html" + window.location.search + window.location.hash);
+        window.location.replace("/m/" + window.location.search + window.location.hash);
       }
     })();
   </script>