mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 13:01:00 +00:00
A trailing space from the portal's copy button reached WHOOP verbatim and answered as an unknown client; the credential schema trims both fields. The redirect override fell through nullish coalescing, so the empty string the compose whitelist materialises for an unset var was sent as the literal redirect target — empty now derives the callback from the app URL.