---
id: 56593092-b2ed-48ab-8718-94b4da69d3b9
author: null
created: 2026-10-27T19:53:10.499706345Z
---
Fixed in PR #61 (`3df93c3a-bd5e-43f4-bb73-0f3dd886eeb1`, commit `ee6e71b`, merged `e834a46`). CI run `2026-10-27T19-50-04.907798288Z` passed; full `cargo test`, `node --test tests/pages_inbox.test.mjs`, fmt, and clippy green.

`static_not_found` resolves `404.html` and requires it to stay under resolved `www`; an outside symlink falls back to the branded stub without leaking the target. Combined serve test also covers Referrer-Policy and the bundle symlink.