From 89c1a13b8b77b76fad0c3b4fcd91d48b06c20fec Mon Sep 17 00:00:00 2001
From: Jeena <hello@jeena.net>
Date: Mon, 12 Oct 2026 00:27:08 +0000
Subject: [PATCH] docs: Drop instance-specific storage-security notes

The public repo must not document this instance's object-storage
access-control posture; findings like that belong in private ops
notes. The engineering guidance (never rely on URL obscurity, always
request file tokens) stays.
---
 .gitignore |  4 +++-
 AGENTS.md  |  7 ++++---
 BACKLOG.md | 14 ++++++++------
 3 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/.gitignore b/.gitignore
index f89a0ab..8685299 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,4 +7,6 @@
 /app/build
 /captures
 .externalNativeBuild
-.cxxreports/*-shots/
+.cxx
+reports/*-shots/
+reports/*.md
diff --git a/AGENTS.md b/AGENTS.md
index 1e68716..bc283be 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -69,9 +69,10 @@ setup/login screen, `Ready` renders `HomeScreen`, which switches content on a
     whose media lives in a private object-storage bucket — pass the short-lived
     `POST /api/v1/videos/{shortUuid}/token` token as `?videoFileToken=` on those URLs
     (response shape: `{ files: { token, expires } }`; verified live).
-  - tube.jeena.net itself streams non-public media from a **publicly readable R2
-    bucket** (`pub-….r2.dev`): no auth is enforced there today, but do not rely on
-    that — always request the file token for non-public videos.
+  - Some instances stream non-public media from object-storage hosts with only
+    URL-based access control — never rely on that; always request and use the
+    file token for non-public videos. (Instance-specific findings stay out of
+    the public repo and live in the private ops notes/agent-local instructions.)
 
 ## Conventions
 
diff --git a/BACKLOG.md b/BACKLOG.md
index 947bade..9019380 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -38,12 +38,14 @@ focus colors, always-focusable Sign in with inline validation. Deferred from rev
 - Logout / switch account: sign-out entry exists; add switch-account (re-login screen
   without losing scroll state).
 - Release build: enable `minifyEnabled` + R8 rules, decide signing/versioning.
-- Thumbnails of private/internal videos may 404 — verified on tube.jeena.net:
-  instance thumbnail paths are publicly readable (HTTP 200 without auth); add a
-  fallback poster only if other instances behave differently.
-- Security note for tube.jeena.net: object-storage (R2) media for private test
-  videos is publicly readable without token ("private" only via URL obscurity).
-  Flag to the instance admin; the app must not rely on this laxness.
+- Thumbnails of private/internal videos may 404 — on some instances thumbnail
+  paths are publicly readable while on others they need auth; add a fallback
+  poster only if needed.
+- Security note (verified live against tube.jeena.net): some instances serve
+  non-public media / thumbnails from object storage with only URL-based access
+  control. The app must not rely on that laxness; always send auth headers
+  / file tokens for non-public media. (Detail intentionally omitted from the
+  public repo — report instance-specific findings privately.)
 - Verify `searchTarget=local` channel search behaves well for instances without
   federation; consider `search/video-channels` endpoint as an alternative.
 - Release build: enable `minifyEnabled` + R8 rules, decide on signing, versioning scheme.