security issue with server bundle output

[ghost]

app.use('/', express.static('dist', {index: false}));

The server bundle is being output to the same directory.