Secret bypass
Grant temporary maintenance access with a secret URL.
nuxt-maintainer down --secret incident-review
nuxt-maintainer down --with-secret
Only the SHA-256 token hash is stored. Visiting /<token> sets an opaque HttpOnly, SameSite=Lax, path-wide cookie and redirects to /. HTTPS requests also receive Secure; comparisons are constant-time.
Running up removes the site record, so existing bypass cookies become ineffective immediately. A later window with a new secret also invalidates old cookies. Treat the URL as a credential: it can appear in browser history and operational logs.