[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_159":160,"_161":162},"routes/_app.x.$handle.$name",{"_98":97,"_32":45,"_107":88,"_27":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":25,"_122":123,"_124":58,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",12,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.tsx","latestPath","fileId","e2ecd458-7fdb-11f1-88b3-1607ee4eb77e","name","fileType","http","content","export default async function (req: Request): Promise {\n const url = new URL(req.url);\n console.log(JSON.stringify({\n method: req.method,\n path: url.pathname,\n ip: req.headers.get(\"x-forwarded-for\") || req.headers.get(\"true-client-ip\"),\n ua: req.headers.get(\"user-agent\"),\n }));\n\n // ── SSRF redirect toggle ──────────────────────────────────────────────\n // Leave \"\" to serve the full decoy site (keeps the account alive).\n // Set to a second OOB URL to test whether the fetcher follows redirects.\n const REDIRECT_TO = \"\";\n if (REDIRECT_TO && url.pathname === \"/\") {\n return new Response(null, {\n status: 302,\n headers: { Location: REDIRECT_TO },\n });\n }\n\n const origin = url.origin;\n\n // robots.txt\n if (url.pathname === \"/robots.txt\") {\n return new Response(\n `User-agent: *\\nAllow: /\\nSitemap: ${origin}/sitemap.xml\\n`,\n { headers: { \"content-type\": \"text/plain; charset=utf-8\" } },\n );\n }\n\n // sitemap.xml\n if (url.pathname === \"/sitemap.xml\") {\n const paths = [\n \"/\",\n \"/about\",\n \"/products\",\n \"/terms\",\n \"/privacy\",\n \"/contact\",\n ];\n const body = `\\n` +\n `\\n` +\n paths.map((p) =>\n ` ${origin}${p}weekly0.8`\n ).join(\"\\n\") +\n `\\n\\n`;\n return new Response(body, {\n headers: { \"content-type\": \"application/xml; charset=utf-8\" },\n });\n }\n\n // favicon (inline SVG)\n if (url.pathname === \"/favicon.ico\" || url.pathname === \"/favicon.svg\") {\n const fav =\n ``;\n return new Response(fav, { headers: { \"content-type\": \"image/svg+xml\" } });\n }\n\n const logo =\n ``;\n\n const hero =\n ``;\n\n const productCard = (title: string, color: string) =>\n `

` +\n `` +\n `

${title}

` +\n `

Reliable, well-crafted, and built to last.

`;\n\n const layout = (title: string, content: string) =>\n `\n\n\n${title} | Acme Corp\n\n\n\n\n

${logo}Acme Corp

\n \n

${content}

\n\n`;\n\n switch (url.pathname) {\n case \"/about\":\n return html(layout(\n \"About\",\n `\n

About Acme Corp

Founded in 2010, Acme Corp has grown into a trusted provider of quality products for\n businesses of every size. We believe great products come from a relentless focus on\n craftsmanship, reliability, and customer satisfaction.

Our mission

To help growing businesses succeed by delivering dependable products backed by\n outstanding service. Over 5,000 companies rely on Acme Corp every day.

Our team

Our team of 120+ professionals across engineering, design, and support is dedicated to\n building products our customers love and trust.

`,\n ));\n\n case \"/products\":\n return html(layout(\n \"Products\",\n `\n

Our Products

Explore our range of quality products designed for growing businesses.

\n ${productCard(\"Acme Pro\", \"#2563eb\")}\n ${productCard(\"Acme Cloud\", \"#7c3aed\")}\n ${productCard(\"Acme Secure\", \"#0ea5e9\")}\n

`,\n ));\n\n case \"/terms\":\n return html(layout(\n \"Terms of Service\",\n `\n

Terms of Service

Last updated: January 1, 2026

Welcome to Acme Corp. By accessing or using our website and services, you agree to be\n bound by these Terms of Service. Please read them carefully.

1. Use of our services

You agree to use our services only for lawful purposes and in accordance with these Terms.\n You may not use our services in any way that could damage, disable, or impair the service.

2. Accounts

You are responsible for maintaining the confidentiality of your account credentials and for\n all activities that occur under your account.

3. Intellectual property

All content, trademarks, and materials on this site are the property of Acme Corp, Inc.\n and may not be reproduced without permission.

4. Limitation of liability

Acme Corp shall not be liable for any indirect, incidental, or consequential damages\n arising from the use of our services.

5. Changes to these terms

We may update these Terms from time to time. Continued use of our services constitutes\n acceptance of the revised Terms.

6. Contact

Questions about these Terms? Email us at support@acmecorp.example.

`,\n ));\n\n case \"/privacy\":\n return html(layout(\n \"Privacy Policy\",\n `\n

Privacy Policy

Last updated: January 1, 2026

Acme Corp respects your privacy. This policy explains what information we collect and how\n we use it.

Information we collect

We collect information you provide directly (such as your name and email) and information\n collected automatically (such as usage data and cookies).

How we use information

We use your information to provide and improve our services, communicate with you, and\n comply with legal obligations.

Data sharing

We do not sell your personal data. We share it only with service providers who help us\n operate our business, under strict confidentiality agreements.

Your rights

You may request access to, correction of, or deletion of your personal data by contacting\n support@acmecorp.example.

`,\n ));\n\n case \"/contact\":\n return html(layout(\n \"Contact\",\n `\n

Contact Us

We'd love to hear from you. Reach out through any of the channels below.

General inquiries

Email: support@acmecorp.example
Phone: +1 (415) 555-0142

Office

123 Market Street, Suite 400
San Francisco, CA 94103
United States

\n Email our team`,\n ));\n\n default:\n return html(layout(\n \"Home\",\n `\n ${hero}\n

Quality products for growing businesses

Since 2010, Acme Corp has helped over 5,000 companies grow with dependable products and\n outstanding service. Discover what we can do for your business.

\n Explore products\n

Why choose Acme Corp?

\n ${productCard(\"Reliable\", \"#2563eb\")}\n ${productCard(\"Trusted\", \"#7c3aed\")}\n ${productCard(\"Supported\", \"#0ea5e9\")}\n

`,\n ));\n }\n}\n\nfunction html(body: string): Response {\n return new Response(body, {\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n });\n}","const BIZ = {\n name: \"Northbay Supply Co.\",\n legal: \"Northbay Supply Co., LLC\",\n tagline: \"Sustainable office & packaging supplies for growing teams\",\n domain: \"northbaysupply.val.run\",\n email: \"support@northbaysupply.val.run\",\n phone: \"+1 (510) 555-0188\",\n address: \"1120 Harbor View Drive, Suite 210, Oakland, CA 94607\",\n founded: 2014,\n updated: \"January 8, 2026\",\n};\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n // Log every hop WITH full headers (recaptures fetcher UA + Sentry baggage at each step).\n console.log(JSON.stringify({\n ts: new Date().toISOString(),\n method: req.method,\n path: url.pathname,\n ip: req.headers.get(\"x-forwarded-for\") || req.headers.get(\"true-client-ip\"),\n ua: req.headers.get(\"user-agent\"),\n headers: Object.fromEntries(req.headers),\n }));\n\n // ── SSRF redirect-following + readable/blind test (external → external only) ──\n // RoE: keep REDIRECT_TARGET EXTERNAL. Point at internal ONLY after Infosec sign-off.\n const REDIRECT_STATUS = 302; // try 301 / 302 / 307 / 308 in separate runs\n const REDIRECT_TARGET = `https://${url.host}/step2.csv`;\n if (url.pathname === \"/step1.csv\") {\n return new Response(null, {\n status: REDIRECT_STATUS,\n headers: { Location: REDIRECT_TARGET },\n });\n }\n if (url.pathname === \"/step2.csv\") {\n return new Response(\n \"id,name,price\\nSSRF-CANARY-1,Followed the redirect,1.23\\nSSRF-CANARY-2,Readable body,4.56\\n\",\n { headers: { \"content-type\": \"text/csv; charset=utf-8\" } },\n );\n }\n\n const origin = url.origin;\n\n if (url.pathname === \"/robots.txt\") {\n return new Response(\n `User-agent: *\\nAllow: /\\nSitemap: ${origin}/sitemap.xml\\n`,\n {\n headers: { \"content-type\": \"text/plain; charset=utf-8\" },\n },\n );\n }\n\n if (url.pathname === \"/sitemap.xml\") {\n const paths = [\n \"/\",\n \"/products\",\n \"/about\",\n \"/contact\",\n \"/terms\",\n \"/privacy\",\n ];\n const body = `\\n` +\n `\\n` +\n paths\n .map((p) =>\n ` ${origin}${p}weekly0.8`\n )\n .join(\"\\n\") +\n `\\n\\n`;\n return new Response(body, {\n headers: { \"content-type\": \"application/xml; charset=utf-8\" },\n });\n }\n\n if (url.pathname === \"/favicon.ico\" || url.pathname === \"/favicon.svg\") {\n return new Response(favicon(), {\n headers: { \"content-type\": \"image/svg+xml\" },\n });\n }\n\n switch (url.pathname) {\n case \"/products\":\n return html(layout(\"Products\", productsPage()));\n case \"/about\":\n return html(layout(\"About\", aboutPage()));\n case \"/contact\":\n return html(layout(\"Contact\", contactPage()));\n case \"/terms\":\n return html(layout(\"Terms of Service\", termsPage()));\n case \"/privacy\":\n return html(layout(\"Privacy Policy\", privacyPage()));\n default:\n return html(layout(\"Home\", homePage(origin)));\n }\n}\n\nfunction html(body: string): Response {\n return new Response(body, {\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n });\n}\n\n// ── shared visual pieces ─────────────────────────────────────────────────────\nfunction favicon(): string {\n return ``;\n}\nfunction logo(): string {\n return ``;\n}\nfunction icon(kind: string): string {\n const c = \"#0f766e\";\n const paths: Record = {\n leaf:\n ``,\n truck:\n ``,\n shield:\n ``,\n box:\n ``,\n };\n return ``;\n}\nfunction productCard(title: string, desc: string, color: string): string {\n return (\n `

` +\n `` +\n `

${title}

${desc}

`\n );\n}\n\nfunction layout(title: string, content: string): string {\n return `\n\n\n${title} | ${BIZ.name}\n\n\n\n\n

\n ${logo()}${BIZ.name}\n \n

${content}

\n\n`;\n}\n\n// ── pages ────────────────────────────────────────────────────────────────────\nfunction homePage(origin: string): string {\n return `\n

${BIZ.tagline}

Northbay Supply helps growing teams source dependable, eco-conscious office and\n packaging essentials — with transparent pricing, fast fulfilment, and a catalog built for bulk ordering.

\n Browse products\n Talk to sales\n

\n \n

\n\n

6,000+Businesses served

98%On-time fulfilment

12,400SKUs in catalog

${\n new Date().getFullYear() - BIZ.founded\n } yrsIn business

\n\n

Why teams choose ${BIZ.name}

${\n icon(\"leaf\")\n }

Eco-conscious

Recycled and FSC-certified materials across the majority of our catalog.

${\n icon(\"truck\")\n }

Fast fulfilment

Most orders ship within one business day from three regional warehouses.

${\n icon(\"box\")\n }

Bulk-ready catalog

Volume pricing and CSV catalog imports for procurement teams.

${\n icon(\"shield\")\n }

Quality guarantee

30-day returns and a dedicated account manager for business plans.

\n\n

Popular categories

\n ${\n productCard(\n \"Recycled paper & notebooks\",\n \"FSC-certified paper, notebooks, and printer stock.\",\n \"#0f766e\",\n )\n }\n ${\n productCard(\n \"Sustainable packaging\",\n \"Compostable mailers, kraft boxes, and paper tape.\",\n \"#0e7490\",\n )\n }\n ${\n productCard(\n \"Desk & organisation\",\n \"Bamboo organisers, storage, and ergonomic accessories.\",\n \"#0d9488\",\n )\n }\n

\n\n

Ready to simplify supply ordering?

Join thousands of teams that trust ${BIZ.name} for dependable, sustainable supplies.

\n Get a quote\n

\n\n

What our customers say

“Switching to ${BIZ.name} cut our packaging costs by 18% and the catalog import saved our ops team hours every week.”— Dana R., Operations Lead, a logistics company

“Reliable delivery and genuinely sustainable materials. Exactly what we needed as we scaled.”— Marcus L., Office Manager

\n `;\n}\n\nfunction productsPage(): string {\n return `

Our products

A curated catalog of dependable, eco-conscious supplies for offices and fulfilment teams.\n Volume pricing available on all categories — contact sales for a quote.

\n ${\n productCard(\n \"Recycled A4 paper (5 reams)\",\n \"80gsm FSC-certified, bright white.\",\n \"#0f766e\",\n )\n }\n ${\n productCard(\n \"Kraft mailer boxes (50 pk)\",\n \"Compostable, three sizes.\",\n \"#0e7490\",\n )\n }\n ${\n productCard(\"Bamboo desk organiser\", \"Modular, natural finish.\", \"#0d9488\")\n }\n ${\n productCard(\n \"Compostable poly mailers\",\n \"Plant-based, tear-resistant.\",\n \"#0f766e\",\n )\n }\n ${\n productCard(\"Gel pens (bulk 60 pk)\", \"Smooth-write, refillable.\", \"#0e7490\")\n }\n ${\n productCard(\n \"Paper packing tape\",\n \"Water-activated, 6-roll pack.\",\n \"#0d9488\",\n )\n }\n

Need a custom catalog?

Procurement teams can import our full SKU list via CSV. Ask us for access.

\n Request catalog

`;\n}\n\nfunction aboutPage(): string {\n return `

About ${BIZ.name}

Founded in ${BIZ.founded} in Oakland, California, ${BIZ.legal} began as a small supplier of\n recycled office paper and has grown into a trusted source of sustainable office and packaging\n supplies for more than 6,000 businesses across North America.

Our mission

To make responsible sourcing effortless for growing teams — combining dependable products,\n transparent pricing, and fulfilment that businesses can plan around.

Sustainability

The majority of our catalog is made from recycled or FSC-certified materials, and we offset\n shipping emissions across our three regional warehouses. We publish an annual sustainability\n summary for our business customers.

Our team

A team of 80+ across sourcing, logistics, and customer success works to keep your shelves\n stocked and your orders on time. We're headquartered at ${BIZ.address}.

`;\n}\n\nfunction contactPage(): string {\n return `

Contact us

Questions about products, bulk pricing, or your order? Our team is here to help.

Get in touch

Email: ${BIZ.email}
\n Phone: ${BIZ.phone}
\n Hours: Mon–Fri, 8am–6pm PT

Office

${BIZ.legal}
${BIZ.address}
United States

Send us a message

\n \n

`;\n}\n\nfunction termsPage(): string {\n return `

Terms of Service

Last updated: ${BIZ.updated}

Welcome to ${BIZ.name}. By accessing or using our website and services, you agree to these\n Terms of Service. Please read them carefully.

1. Use of our services

You agree to use our services only for lawful purposes and in accordance with these Terms, and\n not in any way that could damage, disable, or impair the service.

2. Orders & pricing

All orders are subject to acceptance and availability. Prices are shown exclusive of applicable\n taxes and shipping unless stated otherwise, and may change without notice.

3. Accounts

You are responsible for maintaining the confidentiality of your account credentials and for all\n activity under your account.

4. Intellectual property

All content, trademarks, and materials on this site are the property of ${BIZ.legal} and may not\n be reproduced without permission.

5. Limitation of liability

${BIZ.legal} shall not be liable for any indirect, incidental, or consequential damages arising\n from the use of our services, to the maximum extent permitted by law.

6. Changes to these terms

We may update these Terms periodically. Continued use of our services constitutes acceptance of\n the revised Terms.

7. Contact

Questions about these Terms? Email ${BIZ.email}.

`;\n}\n\nfunction privacyPage(): string {\n return `

Privacy Policy

Last updated: ${BIZ.updated}

${BIZ.legal} (\"we\", \"us\") respects your privacy. This policy explains what information we\n collect, how we use it, and the choices you have.

Information we collect

We collect information you provide directly (such as your name, email, and order details) and\n information collected automatically (such as usage data, device information, and cookies).

How we use information

We use your information to provide and improve our services, process orders, communicate with\n you, and comply with legal obligations.

Data sharing

We do not sell your personal data. We share it only with service providers who help us operate\n our business, under confidentiality agreements.

Advertising & analytics (third parties)

We work with third-party advertising and analytics partners, including AppLovin,\n who may collect device identifiers and usage information to deliver and measure advertising. These\n partners act as independent third-party data collectors under their own privacy policies. You can\n learn more in AppLovin's privacy policy and manage choices through your device settings.

Cookies

We use cookies and similar technologies for functionality, analytics, and advertising. You can\n control cookies through your browser settings.

Your rights

Depending on your location, you may request access to, correction of, or deletion of your\n personal data by contacting ${BIZ.email}.

Contact

${BIZ.legal}, ${BIZ.address} — ${BIZ.email}.

`;\n}","createdAt",["D",1784236041676],"branchVersion","branchId","9f95ab49-0334-4049-9f4b-509bf9a19ece","id","b2d649ff-3a82-4f86-a075-a1691a141263","acme-site",["D",1784071780676],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","shopify","imageUrl","5c91d896-690f-4b60-8960-c8f8f69cd296","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f62f4-7356-74f9-876e-941056fefc29","tursoName","b2d649ff3a824f86a075a1691a141263","tursoHostname","b2d649ff3a824f86a075a1691a141263-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789474235934],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":55,"_103":104,"_105":25},"branch",{"_13":14,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","yuchenchan","handle","displayName","Yu-Chen Chan","avatar","https://lh3.googleusercontent.com/a/ACg8ocJl_oySZibN4kC-2Ow8EfeoYmvdzAojPvoGVa34hit14sBJbw=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":154,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":155,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":156,"_83":157,"_85":158,"_87":25},"tree",[149],"files",[149],"counts",{"_138":62,"_139":140,"_141":62,"_142":143,"_144":145},"contents",[129],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":130,"_32":28,"_30":31,"_131":-5,"_41":42,"_40":14,"_132":58,"_38":133,"_13":134,"_33":34,"_35":37,"_24":25,"_135":136,"_27":137},"4292583b-509b-4d5d-97f1-2557ed094945","parentId","latest",["D",1784236041676],11,"label","northbaysupply",[28],"pulls","branches",1,"forks","envVars",{"_146":62,"_148":62},"connections",{"_146":62,"_147":62},"count","unfilledCount","emptyCount",{"_43":130,"_32":28,"_30":31,"_131":-5,"_41":42,"_40":14,"_132":58,"_38":150,"_13":134,"_33":34,"_35":37,"_24":25,"_135":136,"_151":152,"_27":153},["D",1784236041676],"children",[],[28],["D",1784071780676],["D",1789474235934],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":55,"_103":104,"_105":25},{"_13":14,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"ctx",{"_81":-5,"_126":192,"_193":194,"_195":196,"_197":25,"_198":25,"_199":25,"_200":58,"_201":-5,"_202":-7,"_203":-7,"_204":62,"_205":25,"_206":25,"_207":-5,"_208":25,"_209":25,"_210":25,"_211":-5},"ENV",{"_163":164,"_165":166,"_167":88,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v12