server: add 404 guard for .bak/.pre- snapshot paths

1279c632e94ddb7b38d2fe7cca0c75dc69a2edd3 · 2026-05-19 18:33:48 -0700 · SteveStudio2

Prevents accidental exposure of any backup/snapshot file that ever
lands in public/. Runs before express.static so the static handler
never gets a chance to serve them.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 1279c632e94ddb7b38d2fe7cca0c75dc69a2edd3
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 18:33:48 2026 -0700

    server: add 404 guard for .bak/.pre- snapshot paths
    
    Prevents accidental exposure of any backup/snapshot file that ever
    lands in public/. Runs before express.static so the static handler
    never gets a chance to serve them.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server.js b/server.js
index 2347570..d9d2a3d 100644
--- a/server.js
+++ b/server.js
@@ -7,6 +7,16 @@ const PORT = process.env.PORT || 9916;
 const DOMAIN = 'designerssalesreps.com';
 
 app.use(express.json());
+
+// Hard 404 guard: never serve snapshot/backup files even if they
+// land in public/. Mirrors the standing fleet rule.
+app.use((req, res, next) => {
+  if (/\.(bak|bak\..+|pre-[^/]+)$/i.test(req.path) || /\.pre-/i.test(req.path)) {
+    return res.status(404).send('Not found');
+  }
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public')));
 
 const reps = JSON.parse(fs.readFileSync(path.join(__dirname, 'data/reps.json'), 'utf8'));

← faa0ec6 gitignore: broaden to cover .bak/.pre- snapshots and claims. · back to Designerssalesreps · fix: convert to 301-redirect server + add deploy scaffold 7bb1bb2 →