diff --git a/src/jira_hub/api.py b/src/jira_hub/api.py
index 14f57e3..ecea01a 100644
--- a/src/jira_hub/api.py
+++ b/src/jira_hub/api.py
@@ -194,8 +194,13 @@ def h_app(hub, conn, m, q, body):
         return 503, Raw("text/html; charset=utf-8", NOT_BUILT)
     rest = unquote(m.group(1) or "")
     if rest.startswith("assets/"):
+        if "\x00" in rest:                       # T1.1: нулевой байт — 404, а не 500 из resolve()
+            raise ApiError(404, "not_found", "/app/" + rest.replace("\x00", "%00"))
         assets = (hub.web_dir / "assets").resolve()
-        f = (hub.web_dir / rest).resolve()
+        try:
+            f = (hub.web_dir / rest).resolve()
+        except (OSError, ValueError):
+            raise ApiError(404, "not_found", "/app/" + rest)
         if not f.is_relative_to(assets) or not f.is_file():
             raise ApiError(404, "not_found", "/app/" + rest)
         return 200, Raw(ASSET_TYPES.get(f.suffix, "application/octet-stream"), f.read_bytes(), ASSET_CACHE)
diff --git a/tests/test_api.py b/tests/test_api.py
index 4f35df8..ae3c9d6 100644
--- a/tests/test_api.py
+++ b/tests/test_api.py
@@ -158,8 +158,7 @@ def test_bad_requests(hub):
     with pytest.raises(HubError) as e:
         c.get("/issues", limit="abc")
     assert e.value.status == 400
-    import urllib.request, urllib.error
-    req = urllib.request.Request(hub["base"] + "/batches", data=b"{not json", method="POST",
+    req =urllib.request.Request(hub["base"] + "/batches", data=b"{not json", method="POST",
                                  headers={"Authorization": "Bearer " + c.token})
     with pytest.raises(urllib.error.HTTPError) as e2:
         urllib.request.urlopen(req)
diff --git a/tests/test_web_app.py b/tests/test_web_app.py
index 24c128c..bfa7007 100644
--- a/tests/test_web_app.py
+++ b/tests/test_web_app.py
@@ -36,6 +36,9 @@ def app_hub(tmp_path):
     (web / "assets" / "index-abc123.js").write_text("console.log('ok')", encoding="utf-8")
     (web / "assets" / "index-abc123.css").write_text("body{}", encoding="utf-8")
     (web / "assets" / "font.bin").write_bytes(b"\x00\x01")
+    for name, data in (("logo.svg", b"<svg/>"), ("p.png", b"\x89PNG"), ("f.ico", b"\x00"), ("f.woff2", b"wOF2"),
+                       ("index-abc123.js.map", b"{}")):
+        (web / "assets" / name).write_bytes(data)
     (tmp_path / "secret.txt").write_text("секрет", encoding="utf-8")
     srv, th, base = _serve(tmp_path, web)
     yield base
@@ -111,3 +114,16 @@ def test_old_board_addresses_redirect_to_app(app_hub, path):
 def test_links_page_is_gone():
     assert not hasattr(api, "PAGE")
     assert not (api.WEB_APP.parent / "links.html").exists()
+
+
+@pytest.mark.parametrize("name,ctype", [("logo.svg", "image/svg+xml"), ("p.png", "image/png"), ("f.ico", "image/x-icon"),
+                                        ("f.woff2", "font/woff2"), ("index-abc123.js.map", "application/json")])
+def test_asset_content_types(app_hub, name, ctype):
+    status, r, _ = _get(app_hub, "/app/assets/" + name)
+    assert status == 200 and r.getheader("Content-Type") == ctype
+
+
+@pytest.mark.parametrize("path", ["/app/assets/%00", "/app/assets/a%00.js", "/app/assets/%00/../index-abc123.js"])
+def test_nul_in_asset_path_is_404(app_hub, path):
+    status, _, _ = _get(app_hub, path)
+    assert status == 404