security: remove express.static('.') — was exposing .env over HTTP

6852df58b538cbe95d54a2f9ecf9e4f1e7dbb457 · 2026-05-11 10:01:50 -0700 · SteveStudio2

express.static('.') on the project root was making .env, server.js, node_modules,
package.json, etc. fetchable as static files. .env contains real SMTP_PASS and
DB_PASSWORD. Anything that needs to be public must live in public/.

Found by security-auditor sweep 2026-05-11.

Files touched

M server.js

Diff

commit 6852df58b538cbe95d54a2f9ecf9e4f1e7dbb457
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Mon May 11 10:01:50 2026 -0700

    security: remove express.static('.') — was exposing .env over HTTP
    
    express.static('.') on the project root was making .env, server.js, node_modules,
    package.json, etc. fetchable as static files. .env contains real SMTP_PASS and
    DB_PASSWORD. Anything that needs to be public must live in public/.
    
    Found by security-auditor sweep 2026-05-11.
---
 server.js | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 4957156..6923d35 100755
--- a/server.js
+++ b/server.js
@@ -753,11 +753,21 @@ const createFiles = () => {
 const app = express();
 const PORT = process.env.PORT || 8200;
 
+// Security headers — added 2026-05-04 (overnight YOLO loop tick 26).
+// CSP disabled because the site embeds inline styles + third-party scripts
+// (Stripe, fonts, etc.) — defer hardening CSP until each script source is
+// catalogued. Other Helmet headers (X-Content-Type-Options, X-Frame-Options
+// SAMEORIGIN, Strict-Transport-Security, Referrer-Policy, X-DNS-Prefetch-
+// Control, X-Download-Options, X-Permitted-Cross-Domain-Policies) all apply.
+const helmet = require('helmet');
+app.use(helmet({ contentSecurityPolicy: false }));
+
 // Middleware
 app.use(express.json());
 app.use(express.urlencoded({ extended: true }));
 app.use(express.static('public'));
-app.use(express.static('.'));
+// SECURITY: removed `app.use(express.static('.'))` — was exposing .env, server.js, node_modules, etc.
+// over HTTP. Anything in project root that needs to be public must move to public/ instead.
 
 // API Routes
 const inquiriesRouter = require('./src/routes/inquiries').default;

← 6058b65 tighten .gitignore: add missing standing-rule patterns (tmp/ · back to Jill Website · security: scrub hardcoded admin password from CLAUDE.md + ad 53b173b →