From 36de4ad4a1d63c9c5d3ba18cdf9664170f9c307b Mon Sep 17 00:00:00 2001 From: Mitchell-Johnson Date: Sat, 19 Sep 2026 09:14:30 -0700 Subject: [PATCH] external demo: public-token guidance Co-Authored-By: Claude Fable 5.1 --- examples/external-demo/README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/examples/external-demo/README.md b/examples/external-demo/README.md index 0064957..34b5c5d 100644 --- a/examples/external-demo/README.md +++ b/examples/external-demo/README.md @@ -11,8 +11,9 @@ different origin than Ham Lab. It knows a base URL and a read-only sensor token window.HAMLAB = { base: 'http://10.0.0.234:8100', token: '' } ``` -Anyone who can load the page can read the token, so serve it only where that's acceptable -(it can read sensors and nothing else). Deployed on `core` as the `hamlab-demo` stack — +Anyone who can load the page can read the token. If the page is public, limit the token to +patterns that name nothing you'd mind the world reading (the `hamlab-demo` one shows +hardware numbers and counts, not container or service names). Deployed on `core` as the `hamlab-demo` stack — see Hamlet `docs/docker.md`. Update it with `cp examples/external-demo/index.html /home/core/apps/hamlab-demo/site/`.