Strip product count from unauthenticated /healthz

a8b60f73838ff4101c3eebac042e364ef4f32257 · 2026-07-09 13:44:46 -0700 · Steve Abrams

Red-team FIX2: open /healthz leaked products:<count>; now returns {ok:true}
only (HTTP 200 preserved for keep-alive/uptime probes). Count stays behind
auth via /api/meta.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit a8b60f73838ff4101c3eebac042e364ef4f32257
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jul 9 13:44:46 2026 -0700

    Strip product count from unauthenticated /healthz
    
    Red-team FIX2: open /healthz leaked products:<count>; now returns {ok:true}
    only (HTTP 200 preserved for keep-alive/uptime probes). Count stays behind
    auth via /api/meta.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 server.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/server.js b/server.js
index 8d07da8..3c05d91 100644
--- a/server.js
+++ b/server.js
@@ -94,8 +94,9 @@ async function load() {
   console.log(`[fromental] loaded ${products.length} products (${products.filter((p) => p.enriched).length} enriched)`);
 }
 
-// health probe BEFORE auth (deploy smoke + uptime monitors)
-app.get('/healthz', (_req, res) => res.json({ ok: true, products: SNAP.count, lastRefresh: LAST_REFRESH }));
+// health probe BEFORE auth (deploy smoke + uptime monitors) — bare liveness only,
+// no catalog size/detail leaked to the unauthenticated probe (count stays behind auth via /api/meta)
+app.get('/healthz', (_req, res) => res.json({ ok: true }));
 
 app.use((req, res, next) => {
   const [scheme, b64] = (req.headers.authorization || '').split(' ');

← 886861f Fromental internal viewer: Shopify products.json scraper + l · back to Fromental Internal · jsonl-backed data layer: self-contained bundle for Kamatera d3c9132 →