fix: remove leaked bak file from public/, expand .gitignore + guard regex to cover .bak-* date-stamped variants

f3a5999d558592048d462c82a9753a13f0728cd4 · 2026-05-30 21:26:11 -0700 · Steve Abrams

- rm public/index.html.bak-20260526152130 (was served 200 publicly)
- add *.bak-* to .gitignore so date-stamped backups are never tracked
- fix guard regex from \.(bak)$ to \.bak([.-]|$) so .bak-YYYYMMDD paths also return 404

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit f3a5999d558592048d462c82a9753a13f0728cd4
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:26:11 2026 -0700

    fix: remove leaked bak file from public/, expand .gitignore + guard regex to cover .bak-* date-stamped variants
    
    - rm public/index.html.bak-20260526152130 (was served 200 publicly)
    - add *.bak-* to .gitignore so date-stamped backups are never tracked
    - fix guard regex from \.(bak)$ to \.bak([.-]|$) so .bak-YYYYMMDD paths also return 404
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 server.js  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 1140724..7f845c3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,5 +10,6 @@ dist/
 build/
 .next/
 *.bak
+*.bak-*
 *.bak.*
 *.pre-*
diff --git a/server.js b/server.js
index 3b752d0..873b541 100644
--- a/server.js
+++ b/server.js
@@ -154,7 +154,7 @@ require("./_universal-contact")(app, cfg.contact);
 require("./_universal-auth")(app, cfg.auth);
 // Guard: never serve snapshot/backup files from static root.
 app.use((req, res, next) => {
-  if (/\.(bak|pre-[^/]*)$|\.bak\.|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
+  if (/\.bak([.-]|$)|\.pre-[^/]*/i.test(req.path)) return res.status(404).send('Not found');
   next();
 });
 app.use(express.static(path.join(__dirname, 'public')));

← 02710b5 feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Stringwallpaper · clean-url: 301 legacy /foo.html to /foo before static, index 53a9432 →