diff --git a/docs/source/tutorials/render-file.md b/docs/source/tutorials/render-file.md
index 77e7e7c48..4111c62bd 100644
--- a/docs/source/tutorials/render-file.md
+++ b/docs/source/tutorials/render-file.md
@@ -88,6 +88,9 @@ var engine = new Liquid({
         exists () {
             return true
         },
+        contains () {
+            return true
+        },
         resolve(root, file, ext) {
             return file
         }
@@ -95,6 +98,8 @@ var engine = new Liquid({
 });
 ```
 
+{% note warn Path Traversal Vulnerability %}The default value of <code>contains()</code> always returns true. That means when specifying an abstract file system, you'll need to provide a proper <code>contains()</code> to avoid expose such vulnerabilities.{% endnote %}
+
 [fs]: ../api/interfaces/liquid_options_.liquidoptions.html#Optional-fs
 [ifs]: https://github.com/harttle/liquidjs/blob/master/src/fs/ifs.ts
 [fs-node]: https://github.com/harttle/liquidjs/blob/master/src/fs/node.ts
diff --git a/src/fs/fs.ts b/src/fs/fs.ts
index 9bf836f5f..0a0104591 100644
--- a/src/fs/fs.ts
+++ b/src/fs/fs.ts
@@ -9,7 +9,7 @@ export interface FS {
   readFileSync: (filepath: string) => string;
   /** resolve a file against directory, for given `ext` option */
   resolve: (dir: string, file: string, ext: string) => string;
-  /** check if file is contained in `root`, always return `true` by default */
+  /** check if file is contained in `root`, always return `true` by default. Warning: not setting this could expose path traversal vulnerabilities. */
   contains?: (root: string, file: string) => boolean;
   /** defaults to "/" */
   sep?: string;