If you're running Jetty this shouldn't be news since they sent it to the announce list, but they released patches for a directory indexing bug yesterday .
We'll be shipping a patched version in the next Windows patch that goes out for the embedded version, but we already had indexing disabled in the static content handler that's part of that package.
We do *not* automatically disable it for the IdP itself anywhere because it's a container-specific thing to do but I've updated the Jetty 9.3 and the newly posted 9.4 pages  with sections on one simple way to do it with just a web.xml modification. There are a variety of ways to do it in Jetty outlined in their page that would be outside the IdP for those who prefer that.
This sort of thing is strictly the responsibility of deployers, but I wanted to bring it to people's attention.