Share links already had expiry and download caps. The weak spot was mine: I was storing the raw token in SQLite so the UI could show it again later. Anyone with a DB backup then had every active link.
So I fixed that. Create a link and you get the full URL once. After that the box only has a hash. Request logs redact share and signup tokens in URLs. In production Fastify trusts the Cloudflare proxy so rate limits see the real client, not the tunnel hop.
Public share pages stay on Hub (/hub/share/…). Absolute links prefer HUB_BASE_URL. Hub/Admin sessions are a separate story — HttpOnly cookies, short TTL, no shared parent-domain cookie unless I explicitly turn that on.