diff --git a/src/net/http/fs.go b/src/net/http/fs.go
index 90a3729cbd..5819334b5f 100644
--- a/src/net/http/fs.go
+++ b/src/net/http/fs.go
@@ -30,6 +30,12 @@ import (
 // value is a filename on the native file system, not a URL, so it is separated
 // by filepath.Separator, which isn't necessarily '/'.
 //
+// Note that Dir will allow access to files and directories starting with a
+// period, which could expose sensitive directories like a .git directory or
+// sensitive files like .htpasswd. To exclude files with a leading period,
+// remove the files/directories from the server or create a custom FileSystem
+// implementation.
+//
 // An empty Dir is treated as ".".
 type Dir string