This lesson's interactive features are locked, please to keep using them
Source Code and Config Leaks
A web server can expose source code and configuration simply because its static-file boundary is too broad. Imagine you have a podcast app and want to serve some static images:
app.use(express.static("."));
Sure, this serves /public/logo.png, but it also serves /package.json and /src/integrations/ticketProvider.ts!
Express 5 ignores dotfiles like .git and .env by default, but the project root still exposes waaaay more than intended. Serve a deliberately curated directory instead:
app.use(express.static("public"));