Ben-K-Jordan · Ben-K-Jordan · Jul 17, 2026 · Jul 17, 2026
diff --git a/README.md b/README.md
diff --git a/docs/images/answer_loop.gif b/docs/images/answer_loop.gif
diff --git a/docs/images/end_screen.png b/docs/images/end_screen.png
diff --git a/docs/images/home.png b/docs/images/home.png
diff --git a/docs/images/model_answer.png b/docs/images/model_answer.png
diff --git a/docs/images/plan.png b/docs/images/plan.png
diff --git a/docs/images/preflight.png b/docs/images/preflight.png
diff --git a/docs/images/review_hypercorrection.png b/docs/images/review_hypercorrection.png
diff --git a/docs/images/runner_free_recall.png b/docs/images/runner_free_recall.png
diff --git a/docs/images/runner_mcq.png b/docs/images/runner_mcq.png
diff --git a/docs/images/signin.png b/docs/images/signin.png
diff --git a/src/middleware.ts b/src/middleware.ts
@@ -13,6 +13,7 @@ const PUBLIC_PATHS = [
   "/auth/forgot-password",
   "/auth/reset-password",
   "/api/auth",
+  "/api/config", // non-secret runtime flags; signup reads it before a session exists
   "/api/health",
   "/s/", // Session links are shareable; API-level auth guards operations
 ];