diff --git a/server.py b/server.py
index e66f7ea..da20ad0 100644
--- a/server.py
+++ b/server.py
@@ -91,9 +91,15 @@ class Handler(SimpleHTTPRequestHandler):
         self.wfile.write(body)
 
     def do_GET(self):
-        if self.path.split('?')[0] == '/api/scores':
+        path = self.path.split('?')[0]
+        if path == '/api/scores':
             with lock:
                 return self.reply(200, {'scores': public(load())})
+        # Don't hand out the source. Nothing secret lives in it — the .env is not in the image and
+        # the client is public JS regardless — but serving server.py and the asset-pipeline scripts
+        # to anyone who guesses the name is untidy, and it publishes the exact validation rules.
+        if path.endswith(('.py', '.pyc')) or '__pycache__' in path:
+            return self.send_error(404)
         return super().do_GET()
 
     def do_POST(self):