Plan step 38 review: a %00 in the asset path reached realpath(), which throws on a null byte, so the route answered 500 instead of 404; a directory whose name ended in a served extension would have reached response()->file(). Both 404 now. The tests add what the review probed: encoded dot segments and slashes, backslashes, absolute paths, a directory, a very long path and a symbolic link pointing out of a served folder, all 404. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qwx5USif3wFFmxtHg5U1g9