diff --git a/cmd/web/main.go b/cmd/web/main.go
index 63ed37d..a51b45c 100644
--- a/cmd/web/main.go
+++ b/cmd/web/main.go
@@ -5,14 +5,17 @@ import (
 	"context"
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"flag"
 	"fmt"
 	"html/template"
+	"io/fs"
 	"log"
 	"log/slog"
 	"net/http"
 	_ "net/http/pprof"
 	"os"
+	"regexp"
 	"strings"
 	"time"
 	_ "time/tzdata" // help go learn about timezones
@@ -65,6 +68,8 @@ var requiredVars = []string{
 	"SITE_ROOT",
 }
 
+var articlesRE = regexp.MustCompile("^[a-z0-9]+(_[a-z0-9]+)*$")
+
 func enforceEnvVars(requiredVars []string) {
 	for _, v := range requiredVars {
 		if _, ok := os.LookupEnv(v); !ok {
@@ -287,8 +292,20 @@ func main() {
 	r.GET("/articles/:id", func(c *gin.Context) {
 		articleName := c.Param("id")
 
+		if !articlesRE.MatchString(articleName) {
+			c.AbortWithStatus(http.StatusNotFound)
+			return
+		}
+
 		fname := fmt.Sprintf("client/articles/%s.md", articleName)
 
+		if _, err := os.Stat(fname); errors.Is(err, fs.ErrNotExist) {
+			c.AbortWithStatus(http.StatusNotFound)
+			return
+		} else if err != nil {
+			panic(err)
+		}
+
 		body, err := os.ReadFile((fname))
 
 		if err != nil {