Deine Seite erzählt allen längst, woraus sie gebaut ist.

# The dev server is not a web server. It reads from your project
# directory on every request and serves whatever it finds, which is
# why /@fs/ can walk outside the project root at all.

# Wrong, and the single most common way this happens:
npm run dev            # then a tunnel or a host pointed at :5173

# Right:
npm run build          # emits dist/
npm run preview        # serves dist/ locally, to check it first

# Then deploy dist/ as static files. On a host that runs a command
# for you, the build command is 'npm run build' and the publish
# directory is 'dist' (Vite) or 'build' (Create React App).

// vite.config.js  -- source maps off, which is the default but
// worth stating, because a debugging session that flipped it on
// is how most of them end up in production.
export default {
  build: { sourcemap: false },
};

// next.config.js
module.exports = {
  productionBrowserSourceMaps: false,
  // Also drops the "X-Powered-By: Next.js" banner, which is the
  // header that tells a scanner exactly which framework to target.
  poweredByHeader: false,
};

# nginx: stop announcing the version. server_tokens off leaves
# "nginx" but removes the number, which is the part that tells
# someone which published bugs to try.
server_tokens off;

# Anything proxied from PHP, Express or Rails announces itself too:
proxy_hide_header X-Powered-By;
proxy_hide_header X-AspNet-Version;

# Caddy, equivalent:
#   header {
#       -Server
#       -X-Powered-By
#   }

# Express, at the top of the app:
#   app.disable("x-powered-by");

# This is cosmetic on its own. It does not patch anything, it just
# stops handing over the version. Upgrade as well.