demo-unlisted / demo apppublic · unlisted

Unlisted demo

Mode: public, unlisted. Anyone with the link can open this page without signing in, but it is deliberately absent from the directory at auth.repo.box.

What you are looking at

  • A static page served by Caddy's file_server from a platform-managed root.
  • The route was generated by repobox-platform routes render, exactly like the private and listed demos: the edge still asks the control plane first, which answers "public" for this app.
  • Browser-supplied X-RepoBox-* headers are stripped at the edge before that check, so nothing here can be tricked into an identity.
  • Switching this app to private or listed on auth.repo.box takes effect on the next request; no route re-render is needed.

Check it yourself

  • curl -I https://demo-unlisted.repo.box/ → 200 with no cookie required.
  • curl https://auth.repo.box/api/directory → this app is not in the list.