mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-09-30 11:12:35 +02:00
An app opened from the sidebar signs in inside Bambuddy's iframe, but every page sent frame-ancestors 'none', so the browser refused to show /connect/authorize there. That path now gets 'self', like the streaming overlay: every ancestor must be Bambuddy itself, so foreign pages still cannot frame it.