fix: remove leaked public/index.html.bak-* file and tighten bak-blocking middleware + gitignore

abff76844ba91fed08eb45a499c4469835f3615e · 2026-05-30 21:33:10 -0700 · SteveStudio2

- Deleted public/index.html.bak-20260526152130 (was served publicly with 200)
- Fixed server.js middleware regex to block .bak-TIMESTAMP patterns (old regex only caught .bak. and .bak$)
- Added *.bak-* pattern to .gitignore so timestamped bak files are never committed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit abff76844ba91fed08eb45a499c4469835f3615e
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Sat May 30 21:33:10 2026 -0700

    fix: remove leaked public/index.html.bak-* file and tighten bak-blocking middleware + gitignore
    
    - Deleted public/index.html.bak-20260526152130 (was served publicly with 200)
    - Fixed server.js middleware regex to block .bak-TIMESTAMP patterns (old regex only caught .bak. and .bak$)
    - Added *.bak-* pattern to .gitignore so timestamped bak files are never committed
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 server.js  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index a3a7f05..af62bc6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,6 +26,7 @@ out/
 # editor/refactor snapshots — never commit
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
 *.orig
 *~
diff --git a/server.js b/server.js
index 8981d5f..756808b 100644
--- a/server.js
+++ b/server.js
@@ -144,7 +144,7 @@ app.use(require('../_shared/api-vendor-redact'));
 
 // Never serve editor/refactor snapshot files from the static root.
 app.use((req, res, next) => {
-  if (/\.(bak|orig)(\.|$)|\.pre-|~$/i.test(req.path)) return res.status(404).send('Not found');
+  if (/\.(bak|orig)(\.|-)|\.(bak|orig)$|\.pre-|~$/i.test(req.path)) return res.status(404).send('Not found');
   next();
 });
 // Site config — prefer _shared/site-config (canonical) but fall back to an

← de4372d feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to 1950swallpaper · /api/facets counts reflect the active filtered result set (d 4f3f7ef →