Severity: MEDIUM
Location: src/routes.php:72 and 253
Bug: Route registered in public and authenticated groups; first match wins, auth gating depends on order.
Fix: Remove one.
Status: open. Will reply with remediation details when resolved.
[M-1] Duplicate /search route registration
Resolved.
Removed the duplicate $router->get('/search', ...) registration from the authenticated group in src/routes.php. The public-browsing registration at line 72 was already winning the first-match dispatch, so this is purely dead-code cleanup. POST-search routes (save/delete) remain auth-gated.
Locking this thread.
