server: 404 all .bak/.pre-* snapshot files so editor backups never leak via static; .gitignore .pre- + .next/

999827ee758b33aa5433dd346344e13d52f3e843 · 2026-05-18 20:45:03 -0700 · Steve Abrams

Files touched

M .gitignore
M server.js

Diff

commit 999827ee758b33aa5433dd346344e13d52f3e843
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 18 20:45:03 2026 -0700

    server: 404 all .bak/.pre-* snapshot files so editor backups never leak via static; .gitignore *.pre-* + .next/
---
 .gitignore | 2 ++
 server.js  | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/.gitignore b/.gitignore
index 469b046..ac0ff9a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,5 @@ dist/
 build/
 *.bak*
 *.bak
+*.pre-*
+.next/
diff --git a/server.js b/server.js
index b75dcae..bda8895 100644
--- a/server.js
+++ b/server.js
@@ -141,6 +141,14 @@ app.post('/api/send-inquiry', (req, res) => {
 // Health endpoint
 app.get('/health', (req, res) => res.json({ ok: true, service: 'goldleafwallpaper', port: PORT }));
 
+// Never serve editor/snapshot files — .bak / .bak.* / .pre-* leak the full source history
+app.use((req, res, next) => {
+  if (/(\.bak(\.|$)|\.pre-)/i.test(req.path)) {
+    return res.status(404).send('Not found');
+  }
+  next();
+});
+
 // Static files with sane caching for assets (HTML stays fresh)
 app.use(express.static(__dirname, {
   maxAge: '7d',

← 6e1e0ce header: remove duplicate <header> with dwmOpen-contact (was · back to Goldleafwallpaper · grid: persist sort + density slider to localStorage and hydr 7b0a137 →