From 20a742fbf3b4e6b14c02c3514fc2f677934e8e19 Mon Sep 17 00:00:00 2001 From: Oliver Rieger Date: Tue, 4 Aug 2026 17:11:37 +0200 Subject: [PATCH] Stop serving the server's own source MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Nothing secret is in it — the .env never enters the image and the client is public JS regardless — but handing out server.py and the asset-pipeline scripts to anyone who guesses a filename publishes the exact validation rules for free. Co-Authored-By: Claude Opus 5 --- server.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/server.py b/server.py index e66f7ea..da20ad0 100644 --- a/server.py +++ b/server.py @@ -91,9 +91,15 @@ class Handler(SimpleHTTPRequestHandler): self.wfile.write(body) def do_GET(self): - if self.path.split('?')[0] == '/api/scores': + path = self.path.split('?')[0] + if path == '/api/scores': with lock: return self.reply(200, {'scores': public(load())}) + # Don't hand out the source. Nothing secret lives in it — the .env is not in the image and + # the client is public JS regardless — but serving server.py and the asset-pipeline scripts + # to anyone who guesses the name is untidy, and it publishes the exact validation rules. + if path.endswith(('.py', '.pyc')) or '__pycache__' in path: + return self.send_error(404) return super().do_GET() def do_POST(self):