diff --git a/pkg/manifests/bundleloader.go b/pkg/manifests/bundleloader.go
index 6ae30623c..f8e4f19b4 100644
--- a/pkg/manifests/bundleloader.go
+++ b/pkg/manifests/bundleloader.go
@@ -111,15 +111,18 @@ func loadBundle(csvName string, dir string) (*Bundle, error) {
 		Name: csvName,
 	}
 	for _, f := range files {
+		path := filepath.Join(dir, f.Name())
+
 		if f.IsDir() {
+			errs = append(errs, fmt.Errorf("bundle manifests dir contains directory: %s", path))
 			continue
 		}
 
 		if strings.HasPrefix(f.Name(), ".") {
+			errs = append(errs, fmt.Errorf("bundle manifests dir has hidden file: %s", path))
 			continue
 		}
 
-		path := filepath.Join(dir, f.Name())
 		fileReader, err := os.Open(path)
 		if err != nil {
 			errs = append(errs, fmt.Errorf("unable to load file %s: %s", path, err))
diff --git a/pkg/manifests/directory_test.go b/pkg/manifests/directory_test.go
index c408db7d2..dc9ea0f2f 100644
--- a/pkg/manifests/directory_test.go
+++ b/pkg/manifests/directory_test.go
@@ -29,3 +29,12 @@ func TestGetPackage(t *testing.T) {
 	require.Equal(t, 2, len(bundles[1].V1beta1CRDs))
 	require.Equal(t, 1, len(bundles[1].V1CRDs))
 }
+
+func TestLoadBundle(t *testing.T) {
+	var err error
+
+	_, err = loadBundle("test-operator.v0.0.1", "./testdata/invalid_bundle_with_subdir")
+	require.EqualError(t, err, "bundle manifests dir contains directory: testdata/invalid_bundle_with_subdir/foo")
+	_, err = loadBundle("test-operator.v0.0.1", "./testdata/invalid_bundle_with_hidden")
+	require.EqualError(t, err, "bundle manifests dir has hidden file: testdata/invalid_bundle_with_hidden/.hidden")
+}
diff --git a/pkg/manifests/testdata/invalid_bundle_with_hidden/.hidden b/pkg/manifests/testdata/invalid_bundle_with_hidden/.hidden
new file mode 100644
index 000000000..e69de29bb
diff --git a/pkg/manifests/testdata/invalid_bundle_with_hidden/test-operator.clusterserviceversion.yaml b/pkg/manifests/testdata/invalid_bundle_with_hidden/test-operator.clusterserviceversion.yaml
new file mode 100644
index 000000000..9da635915
--- /dev/null
+++ b/pkg/manifests/testdata/invalid_bundle_with_hidden/test-operator.clusterserviceversion.yaml
@@ -0,0 +1,37 @@
+apiVersion: operators.coreos.com/v1alpha1
+kind: ClusterServiceVersion
+metadata:
+  annotations:
+    capabilities: Basic Install
+  name: test-operator.v0.0.1
+  namespace: placeholder
+spec:
+  apiservicedefinitions: {}
+  customresourcedefinitions:
+    owned:
+    - description: Test is the Schema for the tests API
+      kind: Test
+      name: tests.test.example.com
+      version: v1alpha1
+  installModes:
+  - supported: true
+    type: OwnNamespace
+  - supported: true
+    type: SingleNamespace
+  - supported: false
+    type: MultiNamespace
+  - supported: true
+    type: AllNamespaces
+  keywords:
+  - test-operator
+  links:
+  - name: Test Operator
+    url: https://test-operator.domain
+  maintainers:
+  - email: your@email.com
+    name: Maintainer Name
+  maturity: alpha
+  provider:
+    name: Provider Name
+    url: https://your.domain
+  version: 0.0.1
diff --git a/pkg/manifests/testdata/invalid_bundle_with_hidden/test.example.com_tests_crd.yaml b/pkg/manifests/testdata/invalid_bundle_with_hidden/test.example.com_tests_crd.yaml
new file mode 100644
index 000000000..50d0dbfa6
--- /dev/null
+++ b/pkg/manifests/testdata/invalid_bundle_with_hidden/test.example.com_tests_crd.yaml
@@ -0,0 +1,16 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: tests.test.example.com
+spec:
+  group: test.example.com
+  names:
+    kind: Test
+    listKind: TestList
+    plural: tests
+    singular: test
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    served: true
+    storage: true
diff --git a/pkg/manifests/testdata/invalid_bundle_with_subdir/foo/.keep b/pkg/manifests/testdata/invalid_bundle_with_subdir/foo/.keep
new file mode 100644
index 000000000..e69de29bb
diff --git a/pkg/manifests/testdata/invalid_bundle_with_subdir/test-operator.clusterserviceversion.yaml b/pkg/manifests/testdata/invalid_bundle_with_subdir/test-operator.clusterserviceversion.yaml
new file mode 100644
index 000000000..9da635915
--- /dev/null
+++ b/pkg/manifests/testdata/invalid_bundle_with_subdir/test-operator.clusterserviceversion.yaml
@@ -0,0 +1,37 @@
+apiVersion: operators.coreos.com/v1alpha1
+kind: ClusterServiceVersion
+metadata:
+  annotations:
+    capabilities: Basic Install
+  name: test-operator.v0.0.1
+  namespace: placeholder
+spec:
+  apiservicedefinitions: {}
+  customresourcedefinitions:
+    owned:
+    - description: Test is the Schema for the tests API
+      kind: Test
+      name: tests.test.example.com
+      version: v1alpha1
+  installModes:
+  - supported: true
+    type: OwnNamespace
+  - supported: true
+    type: SingleNamespace
+  - supported: false
+    type: MultiNamespace
+  - supported: true
+    type: AllNamespaces
+  keywords:
+  - test-operator
+  links:
+  - name: Test Operator
+    url: https://test-operator.domain
+  maintainers:
+  - email: your@email.com
+    name: Maintainer Name
+  maturity: alpha
+  provider:
+    name: Provider Name
+    url: https://your.domain
+  version: 0.0.1
diff --git a/pkg/manifests/testdata/invalid_bundle_with_subdir/test.example.com_tests_crd.yaml b/pkg/manifests/testdata/invalid_bundle_with_subdir/test.example.com_tests_crd.yaml
new file mode 100644
index 000000000..50d0dbfa6
--- /dev/null
+++ b/pkg/manifests/testdata/invalid_bundle_with_subdir/test.example.com_tests_crd.yaml
@@ -0,0 +1,16 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: tests.test.example.com
+spec:
+  group: test.example.com
+  names:
+    kind: Test
+    listKind: TestList
+    plural: tests
+    singular: test
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    served: true
+    storage: true