diff --git a/VERSION b/VERSION
index 09e9157..53b61ec 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.3.5
\ No newline at end of file
+0.3.6
\ No newline at end of file
diff --git a/server.js b/server.js
index bc4caa1..c1dea14 100644
--- a/server.js
+++ b/server.js
@@ -100,9 +100,6 @@ router.get("/balance", (req, res) => {
   res.json({ balance: "1000.00" });
 });
 
-// Serve static files
-router.use(express.static(path.join(__dirname, "public")));
-
 // GET / - serve main page with injected credentials
 router.get("/", (req, res) => {
   const indexPath = path.join(__dirname, "public", "index.html");
@@ -115,6 +112,9 @@ router.get("/", (req, res) => {
   res.send(html);
 });
 
+// Serve static files (after / route to prevent index.html from being served directly)
+router.use(express.static(path.join(__dirname, "public"), { index: false }));
+
 // Mount router at BASE_PATH
 app.use(BASE_PATH, router);