From 3f5b19d4ba80f3f223f5bf7a378d58749a88e0be Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 18 May 2026 16:43:22 +0000
Subject: [PATCH] Add bot probe filter middleware and Sentry noise suppression

Block common bot scanning paths (wp-admin, .env, .php, etc.) in Express
before React Router handles them, preventing spurious Sentry errors.
Also filter Sentry events for React Flight protocol probes ($1:aa:aa
multipart body pattern) and any remaining bot-path 404 noise.

https://claude.ai/code/session_01Y5Ca6oxd5zyyM89acmogf7
---
 instrument.server.mjs | 11 +++++++++++
 server/app.ts         | 12 ++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/instrument.server.mjs b/instrument.server.mjs
index 9159559..38f9a7e 100644
--- a/instrument.server.mjs
+++ b/instrument.server.mjs
@@ -8,5 +8,16 @@ Sentry.init({
   ignoreErrors: [
     /No route matches URL ".*\.css"/,
     /No route matches URL ".*\.js"/,
+    /No route matches URL ".*\.(php|env|xml|aspx|asp|bak|sql|ini)"/i,
+    /No route matches URL ".*\/(wp-admin|wp-login|phpmyadmin|xmlrpc)"/i,
   ],
+  beforeSend(event) {
+    const url = event.request?.url ?? "";
+    const msg = event.exception?.values?.[0]?.value ?? "";
+    // Drop React Flight protocol probe errors (e.g. $1:aa:aa in multipart body)
+    if (msg.includes("$1:")) return null;
+    // Belt-and-suspenders: drop any remaining bot probe URL errors
+    if (/\.(php|env|htaccess|xml|aspx|bak|sql)$|wp-admin|phpmyadmin/i.test(url)) return null;
+    return event;
+  },
 });
\ No newline at end of file
diff --git a/server/app.ts b/server/app.ts
index 48a9e00..379e435 100644
--- a/server/app.ts
+++ b/server/app.ts
@@ -11,6 +11,18 @@ export const app = express();
 
 app.use((_, __, next) => DatabaseContext.run(db, next));
 
+// Block common bot probe paths before React Router (and Sentry) see them
+const BOT_PROBE_RE =
+  /\.(php|env|git|htaccess|xml|aspx|asp|jsp|config|bak|sql|ini|log|swp|DS_Store)$|^\/(wp-admin|wp-login|phpmyadmin|xmlrpc|server-status|cgi-bin|shell|cmd|console|actuator)(\/|$)/i;
+
+app.use((req, res, next) => {
+  if (BOT_PROBE_RE.test(req.path)) {
+    res.status(404).end();
+    return;
+  }
+  next();
+});
+
 app.use(
   createRequestHandler({
     build: () => import("virtual:react-router/server-build") as unknown as Promise<ServerBuild>,