From 69a303ab001b7c58ba35c694294848d045ab0abd Mon Sep 17 00:00:00 2001 From: Bohdan Triapitsyn Date: Wed, 17 Jun 2026 01:43:13 +0300 Subject: [PATCH] fix: prevent search indexing of self-hosted instances Adds noindex headers to all server responses Adds robots.txt to disallow crawlers --- packages/web/server/index.js | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/packages/web/server/index.js b/packages/web/server/index.js index f4a8a2a5..b8bb35cc 100644 --- a/packages/web/server/index.js +++ b/packages/web/server/index.js @@ -1096,6 +1096,17 @@ async function main(options = {}) { const serverStartedAt = new Date().toISOString(); const packagedClientOrigins = new Set(['openchamber-ui://app']); app.set('trust proxy', true); + // Keep self-hosted instances out of search engines. The app shell is served + // publicly (it loads before prompting for the UI password), so without this + // even a password-protected instance gets crawled and indexed. Applies to + // every response; the robots.txt route makes the intent explicit for crawlers. + app.use((_req, res, next) => { + res.setHeader('X-Robots-Tag', 'noindex, nofollow'); + next(); + }); + app.get('/robots.txt', (_req, res) => { + res.type('text/plain').send('User-agent: *\nDisallow: /\n'); + }); app.use((req, res, next) => { const origin = typeof req.headers.origin === 'string' ? req.headers.origin : ''; if (packagedClientOrigins.has(origin)) {