harden: broaden .gitignore + 404-guard for snapshot files

793d2e234bf2a725b4b5c40da740ad994fd5b993 · 2026-05-19 21:17:54 -0700 · Steve Abrams

- .gitignore now covers *.bak.*, *.pre-*, *.orig, *.rej, *.swp, *~
  (was only *.bak). Prevents editor scratch + Claude pre-edit snapshots
  from sneaking into the repo.
- New Express middleware before express.static returns 404 for any
  request to a snapshot/editor-scratch path so even if one accidentally
  lands under public/ it never serves to a browser.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit 793d2e234bf2a725b4b5c40da740ad994fd5b993
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 21:17:54 2026 -0700

    harden: broaden .gitignore + 404-guard for snapshot files
    
    - .gitignore now covers *.bak.*, *.pre-*, *.orig, *.rej, *.swp, *~
      (was only *.bak). Prevents editor scratch + Claude pre-edit snapshots
      from sneaking into the repo.
    - New Express middleware before express.static returns 404 for any
      request to a snapshot/editor-scratch path so even if one accidentally
      lands under public/ it never serves to a browser.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore | 8 ++++++++
 server.js  | 9 +++++++++
 2 files changed, 17 insertions(+)

diff --git a/.gitignore b/.gitignore
index e33f758..d1b3d72 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,4 +14,12 @@ tmp/
 
 .env.*.local
 .env.*
+
+# Snapshot / editor scratch files — never commit
 *.bak
+*.bak.*
+*.pre-*
+*.orig
+*.rej
+*.swp
+*~
diff --git a/server.js b/server.js
index 08c4903..ec39ea3 100644
--- a/server.js
+++ b/server.js
@@ -9,6 +9,15 @@ const app = express();
 app.use(helmet({ contentSecurityPolicy: false }));
 const PORT = process.env.PORT || 7201;
 
+// Snapshot/editor scratch-file 404 guard — never serve *.bak, *.pre-*, *.orig, etc
+// even if one accidentally lands under public/
+app.use((req, res, next) => {
+  if (/\.(bak|orig|rej|swp)(\?|$)|\.bak\.|\.pre-|~(\?|$)/i.test(req.path)) {
+    return res.status(404).send('Not found');
+  }
+  next();
+});
+
 // Serve static files
 app.use(express.static('public'));

← 56106db snapshot: 1 file(s) changed, ~1 modified · back to New Items Dashboard · feat: sort + density controls on wines & handbags grids 7d0b816 →