[vuln] GET /api/v1/main/flows/configs/configs/revisions (no creds, protected) -> 401 (expect 401: auth enforced)
[vuln] POST /api/v1/main/flows/configs (no creds, /configs suffix, create webhook flow) -> 200 (expect 200)
[vuln] GET /api/v1/main/executions/webhook/configs/configs/variantSecretKey2026 (no creds, OPEN-URL webhook, ends with /<key> NOT /configs) -> 200 (expect 200: open-url bypass + RCE)
[vuln] ALTERNATE-TRIGGER RCE CONFIRMED via open-webhook (isOpenUrl branch): marker=VARIANT_KESTRA_RCE_1783230990_10553
[fixed] POST /api/v1/main/flows/configs (no creds, create) -> 401 (expect 401: fix blocks creation)
[fixed] GET /api/v1/main/executions/webhook/configs/configs/variantSecretKey2026 (no creds) -> 404 (expect NOT 401 = 404: open-url branch still open, flow not found)
[fixed] GET /api/v1/main/flows/configs/configs/revisions (no creds, protected) -> 401 (expect 401)
[fixed] GET /api/v1//configs (double-slash; filter normalizes->/api/v1/configs whitelist, router 404) -> 404 (expect 404: whitelisted but unroutable, harmless)
[fixed] GET /api/v1/configs/ (trailing slash; exact match fails) -> 401 (expect 401: not whitelisted)
[fixed] POST /api/v1/main/flows%2Fconfigs (encoded slash) -> 401 (expect 401 or 404: not a /configs whitelist bypass)
[fixed] no marker file created (expected: creation blocked)
[fixed-setup] GET /api/v1/flows/basicAuth (no creds, matches /api/v1(/[^/]+)?/basicAuth regex) -> 200 (setup: whitelisted; routes via aliasing to FlowController namespace=basicAuth read)
[fixed-setup] GET /api/v1/main/namespace/basicAuth (no creds, two segments, regex no-match) -> 401 (expect 401: fix's own test case)
[fixed-setup] POST /api/v1/flows/basicAuth (no creds) -> 422 (routes to MiscController createBasicAuth setup endpoint; NOT FlowController create)
==========================================
ALTERNATE_TRIGGER_ON_VULNERABLE = yes  (open-url webhook branch, diff endpoint than repro)
FIXED_BLOCKS_CONFIGS_CREATE     = yes
FIXED_WEBHOOK_PATH_STILL_OPEN   = yes  (isOpenUrl untouched by fix; documented open trigger)
BYPASS_RCE_ON_FIXED             = no  (expect no)
==========================================