diff --git a/deployment/vagrant/sites-available/default b/deployment/vagrant/sites-available/default
index 38ad4deb..1882f4a3 100644
--- a/deployment/vagrant/sites-available/default
+++ b/deployment/vagrant/sites-available/default
@@ -22,6 +22,11 @@ server {
         try_files $uri $uri/ =404;
     }
 
+    location /app/data/ {
+        deny all;
+        return 404;
+    }
+
     location /core/ {
         deny all;
     }