Jill Website

noopener alone prevents window.opener tampering but still leaks the
Referer header to third-party destinations. Adding noreferrer closes
that side-channel — every outbound restaurant/yoga/surf/tour link in
the inline HTML template (server.js + auto-generated index.html) and
the EJS partials (index, culinary-delights, surfing, yoga-wellness)
now ships the full noopener noreferrer pair.

60 occurrences upgraded across 6 files. Verified zero bare
rel=noopener occurrences remain outside node_modules/coverage.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Adds a defense-in-depth Express middleware (runs BEFORE express.static)
that returns 404 for any request path ending in .bak / .bak.* / .pre-* /
.orig / .rej / .swp / ~. Applied to both:

- server.js (standalone fallback)
- src/server.ts (PM2 production entrypoint via dist/server.js)

Pairs with the .gitignore broadening in 6087759 — even if a snapshot
file slips into public/ via a sloppy edit, it never serves over HTTP.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Prevents editor/sed/patch artifacts (.bak, .pre-*, .orig, .rej, .swp,
~) from being staged or served — defense-in-depth alongside the
runtime 404-guard middleware.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CLAUDE.md was committing the live admin password 'DWSecure2024!' as
plaintext doc — anyone who cloned the repo had prod credentials. Replaced
with a pointer to ADMIN_PASSWORD env var.

helmet was already require()'d in server.js but missing from
package.json/lock — npm install would fail cold. Adding it now.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

express.static('.') on the project root was making .env, server.js, node_modules,
package.json, etc. fetchable as static files. .env contains real SMTP_PASS and
DB_PASSWORD. Anything that needs to be public must live in public/.

Found by security-auditor sweep 2026-05-11.