Block snapshot/backup files (.bak, .pre-*) from ever leaking case PII

35a33ad7e92effdf68dc25852df1a1677124fcf9 · 2026-05-19 17:21:29 -0700 · SteveStudio2

Adds an Express 404-guard ahead of express.static so any URL matching a
backup/snapshot pattern returns 404 before either static root (public/ or
pdfs/) gets a chance to serve it. Broadens .gitignore so the same files
can't be committed by mistake either.

Defense-in-depth — no such files exist in the tree today, but this server
holds discovery PII (medical, employment, address history) and the cost
of a stray editor backup leaking via a guessable URL is unacceptable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit 35a33ad7e92effdf68dc25852df1a1677124fcf9
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 17:21:29 2026 -0700

    Block snapshot/backup files (*.bak, *.pre-*) from ever leaking case PII
    
    Adds an Express 404-guard ahead of express.static so any URL matching a
    backup/snapshot pattern returns 404 before either static root (public/ or
    pdfs/) gets a chance to serve it. Broadens .gitignore so the same files
    can't be committed by mistake either.
    
    Defense-in-depth — no such files exist in the tree today, but this server
    holds discovery PII (medical, employment, address history) and the cost
    of a stray editor backup leaking via a guessable URL is unacceptable.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore |  9 +++++++++
 server.js  | 11 +++++++++++
 2 files changed, 20 insertions(+)

diff --git a/.gitignore b/.gitignore
index 0482a2d..a38748f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,12 @@ tmp/
 dist/
 build/
 .next/
+
+# Snapshot/backup files — never commit, never serve (2026-05-19)
+*.bak
+*.bak.*
+*.pre-*
+*.pre
+public/**/*.bak
+public/**/*.bak.*
+public/**/*.pre-*
diff --git a/server.js b/server.js
index 1864ea9..a1b5793 100644
--- a/server.js
+++ b/server.js
@@ -52,6 +52,17 @@ app.use((req, res, next) => {
 });
 
 app.use(express.json({ limit: '5mb' }));
+
+// Refuse to serve snapshot/backup files (*.bak, *.bak.*, *.pre-*) from any static
+// root. Defense-in-depth so a stray editor backup or pre-deploy snapshot can never
+// leak case PII via a guessable URL. (2026-05-19, fleet-refactor-sweep)
+app.use((req, res, next) => {
+  if (/\.(bak|pre)(\.|$)|\.pre-/i.test(req.path)) {
+    return res.status(404).type('text').send('Not found.');
+  }
+  next();
+});
+
 app.use(express.static(path.join(ROOT, 'public')));
 app.use('/pdfs', express.static(path.join(ROOT, 'pdfs')));

← f810826 snapshot: 1 file(s) changed, ~1 modified · back to Abrams Discovery Viewer · (newest)