Jacob Leksan
f2cb63140c
- Return 302 to /static/favicon.png instead of streaming the same PNG per model id so browsers can cache one asset for default avatars. - Validate stored /static/ paths with decode, normpath, and /static prefix checks; invalid paths fall back to favicon. Made-with: Cursor