5 Commits

Include renames

Author	SHA1	Message	Date
fen	d013f3965f	Require secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141) ... Query strings leak into Traefik access logs, browser history, and Referer headers. Admin key is now accepted only via X-Admin-Key; paste and can passwords only via X-Paste-Password (or the POST unlock form). Tests updated; new negative cases assert 401 for the query paths.	2026-09-09 23:23:10 -05:00
poslop	9df6224a27	Result box: color-code by status + friendly error messages from error codes (#105) ... - Backend create/can validation paths emit machine-readable error codes (slug_taken, slug_invalid, content_empty, content_too_large, expiry_invalid, rate_limited, ...) alongside the human message - new.html JS maps codes to plain-language guidance with generic fallback - Result card colored via --ok/--err/--warn left border (result-ok/err/warn) - docs/API.md error section documents the code field - Tests assert the code on every validation path	2026-09-09 17:28:25 -05:00
poslop	5b9be808ed	Merge origin/main: keep can listing rows with #65 password-metadata leak guard	2026-09-09 16:36:55 -05:00
poslop	19804d47a3	Cans UI + parity: unlock-cookie flow, /can page, listings badge, custom slug, delete, sweeper; #32 perf notes (#4, #32)	2026-09-09 16:34:51 -05:00
poslop	4f1e901f04	Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)	2026-09-09 01:33:39 -05:00