This is a minimal shared-secret gate. Use proper auth before production.