Don't serve .data directory in static sites

for consistency with the idea that stuff in .data/ can contain secrets

Hey @wh0 thanks for the feedback; I agree this should be prevented and we’ll take a look at it!