gitignore snapshot files + 404-guard backup paths from static root

e8ae740534089c7db8087981002f9ffc4730c31f · 2026-05-19 17:20:30 -0700 · Steve Abrams

Broadens .gitignore to cover *.bak / *.bak.* / *.pre-* / *.orig / *.rej
/ *~ so accidental snapshot files can never sneak into a commit. Adds
an Express middleware ahead of express.static that returns 404 for any
URL matching those extensions, so a stray backup that lands on disk in
public/ still can't leak over HTTP.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit e8ae740534089c7db8087981002f9ffc4730c31f
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 17:20:30 2026 -0700

    gitignore snapshot files + 404-guard backup paths from static root
    
    Broadens .gitignore to cover *.bak / *.bak.* / *.pre-* / *.orig / *.rej
    / *~ so accidental snapshot files can never sneak into a commit. Adds
    an Express middleware ahead of express.static that returns 404 for any
    URL matching those extensions, so a stray backup that lands on disk in
    public/ still can't leak over HTTP.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore |  8 ++++++++
 server.js  | 10 ++++++++++
 2 files changed, 18 insertions(+)

diff --git a/.gitignore b/.gitignore
index fc59ee5..904b1b3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,11 @@ tmp/
 dist/
 build/
 data/subscribers.jsonl
+
+# Snapshot / backup artifacts — must never be committed
+*.bak
+*.bak.*
+*.pre-*
+*.orig
+*.rej
+*~
diff --git a/server.js b/server.js
index 15a6458..aa902f6 100644
--- a/server.js
+++ b/server.js
@@ -6,6 +6,16 @@ const app = express();
 const PORT = process.env.PORT || 9898;
 
 app.use(express.json());
+
+// Guard: never serve backup / snapshot artifacts from static root,
+// even if one accidentally lands in public/.
+app.use((req, res, next) => {
+  if (/\.(bak|orig|rej)(\.|$)|\.pre-|~$/i.test(req.path)) {
+    return res.status(404).send('Not Found');
+  }
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public')));
 
 const products = JSON.parse(fs.readFileSync(path.join(__dirname, 'data/products.json'), 'utf8'));

← ae203c7 add rel="noreferrer" to all target="_blank" external links · back to Fabricfriday · add: pre-stage Meta Pixel snippet (placeholder; flip via _dw ab76fe7 →