if ../ vulns cause problems, that's a sysadmin problem of not deploying the app in an isolated environment, it should be assumed app devs will make these mistakes