twooeyandClaude Sonnet 5
3143128798
They're bind-mounted straight into the webroot (docker-compose.*.yml) and nothing strips them on a git-checkout deploy, so php_fastcgi/file_server would otherwise execute/serve them directly. 404 instead of 403 so their existence isn't confirmed. Verified live against a scratch Caddy instance — plain `*` matches across path segments in Caddy 2.11.4 (the `**` token I first tried did not match nested paths at all). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MqhgnCRjjVLFnZ3Jpn93Vg