Hint 5

Try using ../ to break out of the public directory.

$ curl http://localhost:3001/public/../