gitignore + serve-time 404-guard for .bak/.pre- snapshot files

a5dc24d9f922183cc8051956056c0fb646bcbcab · 2026-05-19 17:24:13 -0700 · SteveStudio2

- broaden .gitignore to cover *.bak, *.bak.*, *.pre-*, .pre-*
- add Express middleware that 404s any .bak/.pre- path before
  express.static so a stray snapshot dropped in public/ can never
  leak. Pre-existing target=_blank links already carry rel=noopener.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit a5dc24d9f922183cc8051956056c0fb646bcbcab
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 17:24:13 2026 -0700

    gitignore + serve-time 404-guard for .bak/.pre- snapshot files
    
    - broaden .gitignore to cover *.bak, *.bak.*, *.pre-*, .pre-*
    - add Express middleware that 404s any .bak/.pre- path before
      express.static so a stray snapshot dropped in public/ can never
      leak. Pre-existing target=_blank links already carry rel=noopener.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore | 5 +++++
 server.js  | 9 +++++++++
 2 files changed, 14 insertions(+)

diff --git a/.gitignore b/.gitignore
index d18e73b..a3b42bb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,3 +21,8 @@ data/password-resets.json.*
 data/uploads/
 data/uploads-meta.json
 
+# Snapshot / backup files — never commit or serve
+*.bak
+*.bak.*
+*.pre-*
+.pre-*
diff --git a/server.js b/server.js
index 5e4530d..7cccc01 100644
--- a/server.js
+++ b/server.js
@@ -106,6 +106,15 @@ app.use(morgan(IS_PROD ? 'combined' : 'dev'));
 app.use(express.json({ limit: '64kb' }));
 app.use(express.urlencoded({ extended: true, limit: '64kb' }));
 
+// Never serve snapshot/backup files even if they land in /public by accident.
+// Matches *.bak, *.bak.*, and any path segment beginning with .pre- or *.pre-*.
+app.use((req, res, next) => {
+  if (/(?:^|\/)(?:\.pre-|[^/]+\.(?:bak|pre-))/i.test(req.path)) {
+    return res.status(404).render('public/404', { title: 'Not found — Butlr' });
+  }
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public'), {
   maxAge: '1h',
   setHeaders(res, p) {

← b52ca5e Fix µ-law decoder bias (33 → 0x84) — root cause of distorted · back to Butlr · amd: silent hangup on machine answer (no voicemail messages) f4b29f0 →