express.static dotfiles option: preventing accidental exposure of .env and .git under a shared root

I am configuring express.static() to serve a user-facing asset directory in an Express 4.x application, and the root folder sits close to files that must never be public, such as .env and .git.

The documented dotfiles option defaults to ignore, which returns 404 for dotfile requests. My uncertainty is the permission boundary: the option only governs dotfile URL handling, and the resolved root path is relative to process.cwd(), so the actual exposure depends on deployment layout rather than any framework-level enforcement. If the working directory changes between environments, a sibling directory containing secrets could fall under the served root without any warning.

I want a configuration strategy that keeps the default ignore behavior but adds a hard guarantee that sensitive paths cannot be served even if the root is misconfigured, without relying solely on directory hygiene.

Is there a documented way to make express.static() fail closed (for example via the fallthrough option or a custom setHeaders check) when a requested path resolves outside an intended allowlist? Should the root be resolved with an absolute path computed at startup, and does Express validate it? Is any of this behavior different in Express 5.x?