404-guard for .bak/.pre-* paths (defense-in-depth, never serve backups)

b555921a45651abc9a780f15fc3ed117b5f2b753 · 2026-05-25 21:07:50 -0700 · steve

Files touched

M server.js

Diff

commit b555921a45651abc9a780f15fc3ed117b5f2b753
Author: steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:07:50 2026 -0700

    404-guard for .bak/.pre-* paths (defense-in-depth, never serve backups)
---
 server.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server.js b/server.js
index ab94544..7cd0332 100644
--- a/server.js
+++ b/server.js
@@ -153,6 +153,11 @@ function decorateColors(items){return items.map(p=>({...p,color_dots:colorDots(p
 
 
 app.use(require('../_shared/api-vendor-redact'));
+// 404-guard: never serve backup/pre-pass files even if they slip into public/.
+app.use((req, res, next) => {
+  if (/\.(bak)(\.|$)|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
+  next();
+});
 app.use(express.json({ limit: "256kb" }));
 // Site config — prefer _shared/site-config (canonical) but fall back to an
 // inline minimal loader so this server.js is self-contained on Kamatera.

← 18d2974 pre-paint hydration for density + view (no grid-column flash · back to Glitterwalls · rails: editorial labels for firing aesthetic buckets d98956a →