Security hardening: stop /server.js exposure & move Replicate token to env

[thesmartshadow]

What

• Prevent server.js from being served as static content (404 guard + no index).
• Replace hard-coded Replicate token with environment variable (REPLICATE_TOKEN).

Why

README guides users to place real API keys and to expose the app via ngrok. With express.static(__dirname) the entire webapp/ folder (including server.js) becomes Internet-reachable. This hardening reduces exposure without changing public behavior.

Testing

• Local run: /server.js is no longer publicly served (404).
• App continues to start; token is read from env when needed.

Tracking

If acceptable, please treat as security hardening/documentation.
Request: after merge, consider opening a GHSA and, if appropriate, requesting a CVE via Google CNA/GitHub CNA.

Credit: Ali Firas (The Smart Shadow)

[thesmartshadow]

Request After merge, please open a GHSA (security hardening) and, if appropriate, request a CVE via Google CNA/GitHub CNA.

[ruofeidu]

Thank you Ali for your contribution! This is a research & intern project and I'm happy to take your contribution!

[thesmartshadow]

Thank you, @ruofeidu!

Update: The hardening change has been merged: #4

Request
• Please label this as security hardening / documentation.
• If possible, open a GitHub Security Advisory (GHSA) referencing this change and, if appropriate, request a CVE via Google CNA / GitHub CNA.

Artifacts
• Before: /server.js publicly downloadable; API key present in client/server.
• After: /server.js returns 404; Replicate token moved to env vars (no client-side secrets).

Credit: Ali Firas (@thesmartshadow)