From 2379d20616a988924924e0500079de7b3dc9966b Mon Sep 17 00:00:00 2001
From: blowing-a-raspberry
 <120271497+blowing-a-raspberry@users.noreply.github.com>
Date: Tue, 6 Oct 2026 14:01:48 -0500
Subject: [PATCH] Harden Vite fs deny for local logs and cache

---
 build/vite.js | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/build/vite.js b/build/vite.js
index 4f2703e88..00479572d 100644
--- a/build/vite.js
+++ b/build/vite.js
@@ -94,7 +94,16 @@ export function createBrowserViteConfig({
       // build/allowedHosts.js); IP addresses are always accepted.
       allowedHosts: [...allowedHosts],
       fs: {
-        deny: ['.env', '.env.*', '*.{crt,pem}', '**/.git/**', '**/ENVIRONMENT'],
+        deny: [
+          '.env',
+          '.env.*',
+          '*.{crt,pem}',
+          '**/.git/**',
+          '**/ENVIRONMENT',
+          '**/.gev-logs/**',
+          '**/.gev-cache/**',
+          '**/dist/**',
+        ],
       },
       // These headers protect the document containing Provider Settings and
       // give the whole page a real Content-Security-Policy (BROWSER_CSP).