Function asset 

pub async fn asset(__arg0: Path<String>) -> Response

GET /v2/{*path} — any other file in the bundle (JS glue, wasm, CSS, and the wasm-bindgen snippets/ tree).

Lookup is an exact match against a static table, so a traversal attempt like ../Cargo.toml simply misses and 404s — there is no filesystem access here.