Security bug fix that allowed all static files being served including .git

nginx.conf

@@ -8,6 +8,18 @@ server {
         try_files $uri $uri/ /index.html;
     }
 
+    # Explicitly deny access to the .git directory
+    location /.git {
+        deny all;
+        return 404;
+    }
+
+    # Allow only .html, .js, and .json files; deny everything else with extensions
+    location ~* \.(?!html$|js$|json$)[^./]+$ {
+        deny all;
+        return 403;
+    }
+
     # Disable caching for all files
     add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
     add_header Pragma "no-cache";