Chimera Security Review not finding anti-abuse token for Heroku NodeJs application

Question

I'm trying to review a Nodejs web application as part of an SF app exchange registration - using Chimera. First hurdle is the review keeps coming back unable to verify it's my app. I've uploaded ChimeraToken.txt to the root folder of the Nodejs app (same folder as app.js). Not sure if this really is the root folder that Chimera can access?

Anyone got experience with Nodejs and Chimera?

Answer 1

So, this doesn't exactly answer the question, but i added tokens to public, app and views folders and it worked.

Update:

Adding the token to the Nodejs static root folder worked. In my case the was /app folder; as indicated:

app.use('/', express.static(__dirname + '/app'));