fix: the /index in app.js

[anupamme]

Summary

Fix high severity security issue in lib/app.js.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	lib/app.js:273
Assessment	Likely exploitable

Description: The /index.json endpoint exposes tile source metadata including internal paths, tile URIs, and backend configuration information without sanitization. While TileJSON is designed to be public, the endpoint may expose sensitive operational details such as internal tile source URIs, backend infrastructure information, and configuration specifics that could aid attackers in reconnaissance.

Evidence

Exploitation scenario: An attacker sends an HTTP GET request to /index.json endpoint.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a web service - vulnerabilities in request handlers are directly exploitable by remote attackers.

Changes

• lib/app.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

---

Automated security fix by OrbisAI Security