fix: remove leaked public backup file and tighten bak-guard regex + .gitignore

b71454b65610401f460c8ced0a2d52dbf42d95b8 · 2026-05-30 21:26:22 -0700 · Steve Abrams

- rm public/index.html.bak-20260526152130 (was served 200 by express.static)
- server.js: fix bak-guard regex to also block .bak-TIMESTAMP filenames (hyphen-suffixed)
- .gitignore: add *.bak-* pattern to prevent timestamped backups from being tracked

Files touched

M .gitignore
M server.js

Diff

commit b71454b65610401f460c8ced0a2d52dbf42d95b8
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:26:22 2026 -0700

    fix: remove leaked public backup file and tighten bak-guard regex + .gitignore
    
    - rm public/index.html.bak-20260526152130 (was served 200 by express.static)
    - server.js: fix bak-guard regex to also block .bak-TIMESTAMP filenames (hyphen-suffixed)
    - .gitignore: add *.bak-* pattern to prevent timestamped backups from being tracked
---
 .gitignore | 1 +
 server.js  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 95b2512..5f02d63 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,5 +11,6 @@ build/
 .next/
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*.bak
 .deploy.conf
diff --git a/server.js b/server.js
index 8b8f9aa..e2f69ef 100644
--- a/server.js
+++ b/server.js
@@ -145,7 +145,7 @@ app.use(require('../_shared/api-vendor-redact'));
 // 404-guard for backup/pre-fix snapshot files — never serve them even if they
 // slip into a deploy dir (defense-in-depth alongside .gitignore + rsync excludes).
 app.use((req, res, next) => {
-  if (/\.(bak|pre-[^/]+)(\.|$)/i.test(req.path)) return res.status(404).send('Not found');
+  if (/\.(bak(-[^/]*)?|pre-[^/]+)(\.|$|\/)/i.test(req.path)) return res.status(404).send('Not found');
   next();
 });
 app.use(helmet({ contentSecurityPolicy: false }));

← 5ed4841 feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Silkwallpaper · noopener,noreferrer on sister-site constellation window.open f2a3aef →