List what may leave, not what must not
My lab dashboard gets backed up as a full snapshot, and that snapshot holds things that should never travel: the app's config with its secrets, its database, and its private TLS key. When I want to share source code from a snapshot, I extract just the code from it.
What went wrong
The first version of that extraction used an exclude list. Skip the config, skip the database. I forgot the certificates folder, and the private key came along with the code into a shared folder. It never left my own network, but the point stands. An exclude list fails silently on the one thing you didn't think of.
The fix
I flipped it around. The extraction now names exactly what may come out: the application code, the web files and a handful of named top-level files. Anything not on the list stays in the archive. If I forget something now, the worst case is that a file I wanted is missing, and that's an easy problem to notice.
Same idea, used again
Later I added a page to the dashboard for viewing and downloading files, so I can hand exact files to whoever needs them. It works the same way. A file can only be served if its location and type are on an allowlist, it's listed in the current file map, and it sits inside its folder with no symlinks along the way.
The permission is worked out fresh on every request. The page never trusts a file on disk to say what's allowed, so editing that file can't widen access. Secrets aren't blocked by a rule that says "not the secrets". They're blocked because nothing ever said they could go.