tminuslabs

Author here. Short version: my Cloudflare Pages build output directory was the repo root, so every committed file was a public URL, including a 150KB internal handoff doc and dot-directories like .claude/ and .github/. No credentials or customer data, but the doc described an admin query parameter that skipped checkout and an unfixed hole in my own schema.

The parts I think are useful beyond my own mistake:

- Two "purge everything" runs did nothing. The headers showed cf-cache-status: DYNAMIC with an age that kept climbing, so the stale copy was in a layer the zone purge doesn't reach. The custom domain served the old file while the pages.dev domain served the clean one.

- A cache-busted request (?cb=random) tells you whether the origin is clean. It does not tell you whether a visitor can still fetch the file. I used it to "verify" the fix twice and was wrong both times.

- What actually closed it was a firewall rule on the path, which runs before cache.

- Rotating the leaked admin string bought almost nothing, because the check was client-side and the value was in the page source all along. The real fix was closing the server-side hole.

Worth a minute: curl your own production domain for README.md, .git/config and your CI files with a plain request. Happy to answer questions.

What is the max distance between nodes in the mesh

Built for space enthusiasts who want one place for upcoming launches, live satellite tracking, and space industry news. The orbital globe shows real-time satellite positions (Starlink, ISS, GPS etc.) with accurate day/night shading based on current solar position. All data pulled live from public APIs. Would love feedback on what's missing or broken.