I found the solution:

#don't ever send $request_filename in your response, it will expose your dir struct, use a quick regex hack to find just the filename
if ($request_filename ~* ^.*?/([^/]*?)$)
{
set $filename $1;
}

if ($filename !~* ^.*?\.(html)|(htm)$)
{
add_header Content-Disposition "attachment; filename=$filename";
}