.forge/issues/84471c41-0394-4e55-a408-0a4fbd5f6fff/comments/47788bc3-21a5-448f-9dae-cddbe739ae12.md

.forge/issues/84471c41-0394-4e55-a408-0a4fbd5f6fff/comments/47788bc3-21a5-448f-9dae-cddbe739ae12.md 531 B 8 lines Raw

id: 47788bc3-21a5-448f-9dae-cddbe739ae12 author: null created: 2026-10-27T19:53:10.574477312Z

Fixed in PR #61 (3df93c3a-bd5e-43f4-bb73-0f3dd886eeb1, commit ee6e71b, merged e834a46). CI run 2026-10-27T19-50-04.907798288Z passed; full cargo test, node --test tests/pages_inbox.test.mjs, fmt, and clippy green.

serve now sends Referrer-Policy: strict-origin-when-cross-origin on static, 404, inbox, and streamed responses. serve_404_headers_and_bundle_symlinks_are_safe asserts it on 200 and 404 responses.

view raw