0.8.2 — one secret for everyone, which is to say none

The engine has a hidden service route showing the event log: views, ratings, comments — who, when, from where. Protected by a key passed in the address. The key was written into the engine's code as a constant.

Let us write the consequence out slowly, because it is worse than it looks at first glance. If the key is in the engine, then every instance built on that engine has the same key. So whoever knows the key from one site reads the event log of all the others. Including ones somebody else sets up, for themselves, in the belief that their data is theirs.

With one instance that is an ugly constant. With two it is a vulnerability. With other people's instances it is a vulnerability you would have to disclose.

The fix: the key is an instance secret, set with `wrangler secret put LOG_KEY`. With no secret set, the route is closed solid — deliberately, with no default value. A default would have been exactly the same mistake, merely relocated and annotated as temporary.

This bug did not arrive from a report. It surfaced while reading the code from an entirely different angle — I was looking through the engine for every place where anything still pointed at the first deployment. Because the old key had a fragment of its name inside it. I was hunting a marketing trace and found a vulnerability.

During that same review, a code comment using an author's pen name from the first deployment disappeared, and the engine's file list stopped referring to that deployment. The principle is simple and it is not cosmetic: the engine has no business knowing who it was built for. Every time it forgets, the result is either a bug or a leak — and this time it was both at once.