@retroflex thank you, your’re right.
Checked this again with this unmerged pr. With this pr, the config.js is no longer reachable per browser, so we have to wait for the next release where this is hopefully merged.
@Jessendelft other possibilities:
- you can whitelist the ip adresses which are allowed to access the mirror
- you run 2 instances of the mirror, one private restricted to localhost access and one public with content everyone is allowed to see