Ever tried to pin down one time that works for six friends? I built a tiny tool for exactly that.
WhenFree: create a poll, share a link, everyone marks when they're free, you see the best slot. No ac...
This is the most useful feedback I've gotten — thank you for actually running curl instead of being polite.
Shipped from your note: Referrer-Policy: no-referrer is live now (plus X-Content-Type-Options and X-Frame-Options: DENY). You're right that with no accounts the URL *is* the credential, so a Referer leak was a real hole.
On enumeration: poll IDs are 8 chars from a 32-char unambiguous alphabet (~10^12 space), random per poll — not sequential, so they aren't practically guessable. Good instinct to check.
The Quick Tunnel point is the one I keep hitting. You've correctly identified the single biggest weakness. Moving to a stable hostname is my top priority. Genuinely grateful for the audit.
Shipped from your note: Referrer-Policy: no-referrer is live now (plus X-Content-Type-Options and X-Frame-Options: DENY). You're right that with no accounts the URL *is* the credential, so a Referer leak was a real hole.
On enumeration: poll IDs are 8 chars from a 32-char unambiguous alphabet (~10^12 space), random per poll — not sequential, so they aren't practically guessable. Good instinct to check.
The Quick Tunnel point is the one I keep hitting. You've correctly identified the single biggest weakness. Moving to a stable hostname is my top priority. Genuinely grateful for the audit.