diff --git a/Network/Wai/Middleware/Static.hs b/Network/Wai/Middleware/Static.hs
--- a/Network/Wai/Middleware/Static.hs
+++ b/Network/Wai/Middleware/Static.hs
@@ -10,10 +10,10 @@
 --   on the file extension and returns the file contents as the response.
 module Network.Wai.Middleware.Static
     ( -- * Middlewares
-      static, staticPolicy
+      static, staticPolicy, unsafeStaticPolicy
     , -- * Policies
       Policy, (<|>), (>->), policy, predicate
-    , addBase, addSlash, contains, hasPrefix, hasSuffix, noDots, only
+    , addBase, addSlash, contains, hasPrefix, hasSuffix, noDots, isNotAbsolute, only
     , -- * Utilities
       tryPolicy
     ) where
@@ -83,20 +83,24 @@
 
 -- | Accept only URIs with given suffix
 hasSuffix :: String -> Policy
-hasSuffix suf = predicate (isSuffixOf suf)
+hasSuffix = predicate . isSuffixOf
 
 -- | Accept only URIs with given prefix
 hasPrefix :: String -> Policy
-hasPrefix pre = predicate (isPrefixOf pre)
+hasPrefix = predicate . isPrefixOf
 
 -- | Accept only URIs containing given string
 contains :: String -> Policy
-contains s = predicate (isInfixOf s)
+contains = predicate . isInfixOf
 
 -- | Reject URIs containing \"..\"
 noDots :: Policy
 noDots = predicate (not . isInfixOf "..")
 
+-- | Reject URIs that are absolute paths
+isNotAbsolute :: Policy
+isNotAbsolute = predicate $ not . FP.isAbsolute
+
 -- | Use URI as the key to an association list, rejecting those not found.
 -- The policy result is the matching value.
 --
@@ -110,12 +114,21 @@
 
 -- | Serve static files out of the application root (current directory).
 -- If file is found, it is streamed to the client and no further middleware is run.
+--
+-- Note: for security reasons, this uses the 'noDots' and 'isNotAbsolute' policy by default.
 static :: Middleware
 static = staticPolicy mempty
 
 -- | Serve static files subject to a 'Policy'
+--
+-- Note: for security reasons, this uses the 'noDots' and 'isNotAbsolute' policy by default.
 staticPolicy :: Policy -> Middleware
-staticPolicy p app req =
+staticPolicy p = unsafeStaticPolicy $ noDots >-> isNotAbsolute >-> p
+
+-- | Serve static files subject to a 'Policy'. Unlike 'static' and 'staticPolicy', this 
+-- has no policies enabled by default, and is hence insecure.
+unsafeStaticPolicy :: Policy -> Middleware
+unsafeStaticPolicy p app req =
     maybe (app req)
           (\fp -> do exists <- liftIO $ doesFileExist fp
                      if exists
diff --git a/changelog.md b/changelog.md
new file mode 100644
--- /dev/null
+++ b/changelog.md
@@ -0,0 +1,8 @@
+## 0.5.0.0
+
+* Add `isNotAbsolute` policy and change `static` and `staticPolicy` to 
+  use `noDots` and `isNotAbsolute` policies by default. (Thanks to Nick Hibberd!)
+
+* Add `unsafeStaticPolicy`, which behaves as the old insecure `staticPolicy` behaved.
+
+* Add changelog
diff --git a/wai-middleware-static.cabal b/wai-middleware-static.cabal
--- a/wai-middleware-static.cabal
+++ b/wai-middleware-static.cabal
@@ -1,13 +1,13 @@
 Name:                wai-middleware-static
-Version:             0.4.0.3
-Synopsis:            WAI middleware that intercepts requests to static files.
+Version:             0.5.0.0
+Synopsis:            WAI middleware that serves requests to static files.
 Homepage:            https://github.com/scotty-web/scotty
 Bug-reports:         https://github.com/scotty-web/scotty/issues
 License:             BSD3
 License-file:        LICENSE
 Author:              Andrew Farmer <afarmer@ittc.ku.edu>
 Maintainer:          Andrew Farmer <afarmer@ittc.ku.edu>
-Copyright:           (c) 2012-2013 Andrew Farmer
+Copyright:           (c) 2012-2014 Andrew Farmer
 Category:            Web
 Stability:           experimental
 Build-type:          Simple
@@ -17,6 +17,8 @@
   if they exist.
   .
   [WAI] <http://hackage.haskell.org/package/wai>
+
+Extra-source-files:    changelog.md
 
 Library
   Exposed-modules:     Network.Wai.Middleware.Static