- Web push (SSRF): reject any endpoint that is not https or whose host is an IP literal / localhost, at both subscribe and send time. Blocks a registered endpoint pointing at the cloud metadata service or an internal address. The guard rejects no legitimate browser push endpoint; unit-tested. - /vote/cast: the admin-secret path bypasses Hasura row-level security, so the ballot is now authorised here — the target must be an open vote/poll and the caller an active member of that poll's context (context taken from the poll, not the client). Fails closed. Authorisation errors return 403 with a safe message; unrelated internal errors are genericised. - Stop leaking raw Hasura error text to clients (admin_gql logs the detail and returns a generic message) and stop logging the secret path of push endpoints. Signed-off-by: Niclas Overby <niclas@overby.me>