fix: return plaintext 404 for anything under appDir (#11597)

Co-authored-by: Rich Harris <[email protected]>

Author: Rich-Harris

.changeset/clever-clocks-drop.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+fix: return plaintext 404 for anything under appDir

packages/kit/src/runtime/server/respond.js

@@ -113,6 +113,10 @@ export async function respond(request, options, manifest, state) {
 		return get_public_env(request);
 	}
 
+	if (decoded.startsWith(`/${options.app_dir}`)) {
+		return text('Not found', { status: 404 });
+	}
+
 	const is_data_request = has_data_suffix(decoded);
 	/** @type {boolean[] | undefined} */
 	let invalidated_data_nodes;