diff --git a/app/api/upload/route.ts b/app/api/upload/route.ts
index 56d019c7..518d6e91 100644
--- a/app/api/upload/route.ts
+++ b/app/api/upload/route.ts
@@ -75,7 +75,7 @@ export async function DELETE(request: NextRequest) {
       return NextResponse.json({ error: "Valid fileName is required" }, { status: 400 });
     }
 
-    if (!fileName.includes(`submissions/${user.id}/`)) {
+    if (!fileName.startsWith(`submissions/${user.id}/`)) {
       return NextResponse.json({ error: "Access denied" }, { status: 403 });
     }