diff --git a/server/main.go b/server/main.go
index 7aa02c7..6cae426 100644
--- a/server/main.go
+++ b/server/main.go
@@ -300,8 +300,15 @@ func proxyHandler(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "Missing key param", http.StatusBadRequest)
 		return
 	}
+	if !strings.HasPrefix(key, s3Prefix+"/") && !strings.HasPrefix(key, "docs/") {
+		http.Error(w, "Forbidden", http.StatusForbidden)
+		return
+	}
 
-	obj, err := s3Client.GetObject(context.Background(), bucketName, key, s3.GetObjectOptions{})
+	ctx, cancel := context.WithTimeout(r.Context(), 60*time.Second)
+	defer cancel()
+
+	obj, err := s3Client.GetObject(ctx, bucketName, key, s3.GetObjectOptions{})
 	if err != nil {
 		log.Printf("Error getting object %s/%s: %v", bucketName, key, err)
 		http.Error(w, "File not found", http.StatusNotFound)
@@ -479,7 +486,9 @@ func healthzHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func readyzHandler(w http.ResponseWriter, r *http.Request) {
-	_, err := s3Client.BucketExists(context.Background(), bucketName)
+	ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
+	defer cancel()
+	_, err := s3Client.BucketExists(ctx, bucketName)
 	if err != nil {
 		msg := fmt.Sprintf("s3 unreachable: %v", err)
 		log.Printf("readyz: %s", msg)