Files
nora/nora-registry
devitway ffac4f0286 fix(auth): replace starts_with with explicit matches for token paths
Prevent accidental exposure of unknown /api/tokens/* sub-paths.
Only the three known routes are now explicitly whitelisted in
is_public_path: /api/tokens, /api/tokens/list, /api/tokens/revoke.
2026-02-22 20:35:04 +00:00
..