fix: remove leaked public bak file, add .bak- to .gitignore, patch 404-guard regex

b3def37242861163e291d28ea2e72ce5e5818173 · 2026-05-30 21:30:52 -0700 · Steve Abrams

- Deleted public/index.html.bak-20260526152130 which was served as HTTP 200 (source leak)
- Added *.bak-* pattern to .gitignore so dash-timestamped backups are excluded
- Fixed 404-guard regex in server.js: original pattern didn't match .bak-<timestamp> filenames

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit b3def37242861163e291d28ea2e72ce5e5818173
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:30:52 2026 -0700

    fix: remove leaked public bak file, add *.bak-* to .gitignore, patch 404-guard regex
    
    - Deleted public/index.html.bak-20260526152130 which was served as HTTP 200 (source leak)
    - Added *.bak-* pattern to .gitignore so dash-timestamped backups are excluded
    - Fixed 404-guard regex in server.js: original pattern didn't match .bak-<timestamp> filenames
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 server.js  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 1140724..3a7a026 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,4 +11,5 @@ build/
 .next/
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
diff --git a/server.js b/server.js
index 4350a20..0f0590f 100644
--- a/server.js
+++ b/server.js
@@ -138,7 +138,7 @@ function sortProducts(list, mode) {
 // 404-guard: never serve backup/pre-edit snapshots even if one slips into a
 // served directory. Returns plain 404 so the bak file's contents never leak.
 app.use((req, res, next) => {
-  if (/\.(bak|pre-[\w.-]+)(\.[\w-]+)?$|\.bak\.\d+$|\.pre-/.test(req.path)) {
+  if (/\.(bak|pre-[\w.-]+)(\.[\w-]+)?$|\.bak[\.-]\d+|\.bak$|\.pre-/.test(req.path)) {
     return res.status(404).type('text/plain').send('Not found');
   }
   next();

← 82aa45e feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Greenwallcoverings · Remove Big Red widget — never UX-worked, collided with Help be8881e →