Do not allow dotfiles in Express static middleware
express.static should not serve dotfiles from disk unless explicitly required and reviewed.
#Metadata
#Why it matters
Allowing dotfiles can expose hidden configuration and secrets through the static file middleware.
#Remediation
Use the default dotfiles ignore behavior or serve dotfiles from a tightly scoped directory with access controls.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.express-static-dotfiles-allow.rule.yaml.