- nginx basic auth on /drops/ (page and clips); login file and clips live
on the server only (docker/auth, docker/drops), never in git or the image
- Fails closed: missing login file returns 500; no-store, noindex
- Page reads manifest.json from the server, shows "taken down" when empty
- Player hides download/cast/PiP, blocks right-click, confidential overlay
- DEPLOY.md step 8: how to share a drop and take it down
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
twotalesanimation