Business Adjacent · Flight Log · FL-009
·reviewtube·locked
Never put the share password in a URL
Signal
Guest download links appended the password as a query parameter.
Wrong turn
Convenience for anchor tags over operational security.
Correction
Short-lived HMAC download tickets; metering still happens on the download edge.
Passwords in query strings land in history, logs, screenshots, and referrers. That is not a theoretical issue; it is a trust failure waiting for a single shared laptop.
Downloads now use time-bound signatures. View counts no longer inflate on processing polls — first open counts, refresh does not. Small edges, same doctrine: security is the trust moat.