Most of munchable.app is one file. Not the marketing pages, which are ordinary, but the bulk: 461 URLs like is onion low FODMAP and is soy sauce gluten free , each answering one question about one ingredient for one digestive condition. 417 of them start is- , 44 start does- , and they all live at the root of the domain with no prefix, because that is the shape of the search they are meant to match.

In Next.js App Router terms that is app/[question]/page.tsx : a dynamic segment sitting directly under app/ , as a sibling of about , recipes , conditions and privacy . It is a slightly alarming thing to own, and this post is the four lines that make it safe plus the one guard that is quietly incomplete.

You can check every claim in it with curl.

The dangerous part of a root-level dynamic segment

A dynamic segment matches whatever reaches it. At the root, "whatever" is every unmatched path on the domain.…