gitignore snapshot files + 404-guard .bak/.pre-/.orig paths under static

f4021885fab60a1c931de9be9a629eaffa9d7a4a · 2026-05-19 21:09:40 -0700 · Steve Abrams

Broadens .gitignore to exclude editor/snapshot backups (*.bak, *.bak.*,
*.pre-*, *.orig, *.rej, *.swp, *~) and adds an Express middleware that
404s any request matching those patterns BEFORE express.static can serve
them, so a stray backup landing in public/ can never leak.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit f4021885fab60a1c931de9be9a629eaffa9d7a4a
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 21:09:40 2026 -0700

    gitignore snapshot files + 404-guard .bak/.pre-/.orig paths under static
    
    Broadens .gitignore to exclude editor/snapshot backups (*.bak, *.bak.*,
    *.pre-*, *.orig, *.rej, *.swp, *~) and adds an Express middleware that
    404s any request matching those patterns BEFORE express.static can serve
    them, so a stray backup landing in public/ can never leak.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore |  9 +++++++++
 server.js  | 11 +++++++++++
 2 files changed, 20 insertions(+)

diff --git a/.gitignore b/.gitignore
index 111b69d..62fae7c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,6 +13,15 @@ tmp/
 uploads/
 coverage/
 
+# snapshot / editor backup files — never commit
+*.bak
+*.bak.*
+*.pre-*
+*.orig
+*.rej
+*.swp
+*~
+
 # yolo loop runtime artifacts — keep the scripts + prompt, ignore logs/locks
 .yolo/yolo-loop.log
 .yolo/launchd-out.log
diff --git a/server.js b/server.js
index 194dfd0..ef20a56 100644
--- a/server.js
+++ b/server.js
@@ -51,6 +51,17 @@ app.use(morgan(morganFormat));
 
 app.use(express.json({ limit: '512kb' }));
 app.use(express.urlencoded({ extended: true, limit: '512kb' }));
+
+// Hard 404 guard for editor/snapshot backups so that even if a stray
+// `.bak`, `.bak.*`, `.pre-*`, `.orig`, `.rej`, `.swp`, or `*~` file
+// lands under public/ it can never be served. Runs BEFORE express.static.
+app.use((req, res, next) => {
+  if (/\.(bak|orig|rej|swp)(\.|$)|\.pre-|~$/i.test(req.path)) {
+    return res.status(404).json({ error: 'not_found' });
+  }
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public'), { maxAge: '1h' }));
 
 app.use((req, res, next) => {

← 3c385b4 snapshot — gitify backup 2026-05-19 · back to Lifestyle Asset Intel · add noreferrer to topnav external-target links bf3e286 →