- Add 🔥 Burn checkbox on the create page (next to Discuss)
- New DB columns: burn_after_read (INTEGER) and burn_token (TEXT) with
automatic migration for existing databases
- POST /api/burn/<paste_id> endpoint: validates a one-time burn_token
(constant-time comparison), deletes paste + comments atomically
- burn_token embedded as a JSON island in view.html so paste_view.js
can read it without Jinja in external scripts
- After successful decryption, scheduleBurn() fires 1.5 s later so
the user has time to read/copy before the paste is destroyed
- showBurnBanner() inserts a warm amber warning strip (slides in with
animation) informing the viewer the paste will self-destruct
- Burn is intentionally NOT persisted to localStorage — it's a
deliberate per-paste choice, not a sticky preference
- Server responds 200 even if paste is already gone (idempotent)
- config.json now in .gitignore — it contained admin password hash and
secret_key placeholder which should never be in version control
- Add config.example.json as a safe, secrets-free template for new deployments
- Add nginx.conf.example with proper reverse-proxy guards:
- Static files served by Nginx directly (not Flask)
- Explicit deny on .py, .json, .db, .log, .env and other sensitive extensions
- Block dot-files and __pycache__ paths
- No directory listing (autoindex off)
- HTTPS enforcement with HSTS
Antigravity
ComputerTech