b53fc07dd16aa735c07a23ade2170366ebdf0429
The game is not public yet. parse_request is the one place every method passes through, so the gate sits there rather than in each do_*. /api and /ws stay open because the iOS shell talks to prod from capacitor://localhost and has no credentials to send. SPLAT_AUTH overrides it; empty opens the site again. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Languages
JavaScript
75.2%
Python
15.8%
HTML
7.3%
Shell
1.4%
Swift
0.2%