builder-smoke-test

The fragment documents normal authentication testing but deliberately enables a route that returns the full session Cookie header, then instructs the tester to copy the credential for curl requests. This is a sensitive-token exposure risk if the route is accessible beyond the intended local test context. The fragment alone does not show whether the endpoint is restricted or whether any token is sent to an external party; malicious intent is not established.

The fragment is not evidently malware, but it contains a deliberately gated endpoint that returns request cookies and can expose session credentials if enabled and reachable. Ensure the smoke-test flag is disabled outside controlled testing and that the route is protected or removed.