2 Commits

Include renames

Author	SHA1	Message	Date
fen	d013f3965f	Require secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141) ... Query strings leak into Traefik access logs, browser history, and Referer headers. Admin key is now accepted only via X-Admin-Key; paste and can passwords only via X-Paste-Password (or the POST unlock form). Tests updated; new negative cases assert 401 for the query paths.	2026-09-09 23:23:10 -05:00
poslop	19804d47a3	Cans UI + parity: unlock-cookie flow, /can page, listings badge, custom slug, delete, sweeper; #32 perf notes (#4, #32)	2026-09-09 16:34:51 -05:00