How to prevent express.static() from serving files from directories starting with a dot?

Question

Node.js

The express.static() module returns files on request.
If the first character in the file name is a dot (hidden file), an error is returned, as it should be. There is an option to turn it back on.
I do not understand how to make the same ban on directories. If I create a directory with a dot, and put a file without a dot in it, I can safely download it.
How to do?