Lookspan's docs say: with --token set, /api/* requires an Authorization header.Express routes case-insensitively. The au...

Lookspan's docs say: with --token set, /api/* requires an Authorization header.Express routes case-insensitively. The auth guard asked req.path.startsWith('/api'), which does not.So the guard and the router disagreed about what a path was, and requests fell through the gap:GET /API/traces → 200, the entire database, no token.POST /API/ingest → 200, accepted 1, and the span was stored.One capital letter. Read and write. And the token is the only th…#security #express #ai #observability