MingalarGo

Development review desk

One shared password from DEV_ADMIN_PASSWORD opens this desk. It is not an account, not role-based access, and it must be replaced before any public deployment. A fresh .env copies dev-admin-change-me from .env.example.

The session cookie is HttpOnly and SameSite=Lax. It is not marked Secure, because this preview is served over local HTTP. Do not expose the process on a network you do not trust.