diff --git a/apps/code/src/server/index.tsx b/apps/code/src/server/index.tsx
index f7fb8ae..516803a 100644
--- a/apps/code/src/server/index.tsx
+++ b/apps/code/src/server/index.tsx
@@ -9,8 +9,9 @@ import type { Child } from 'hono/jsx'
 const APPS_DIR = process.env.APPS_DIR!
 
 const safePath = (base: string, ...segments: string[]) => {
-  const full = resolve(base, ...segments)
-  if (!full.startsWith(base + '/') && full !== base) return null
+  const norm = resolve(base)
+  const full = resolve(norm, ...segments)
+  if (!full.startsWith(norm + '/') && full !== norm) return null
   return full
 }