A hidden button is not access control. Unknown permissions are denied by default.
Code and evidence
Pinned source links show the implementation and existing test files. Startup commands and documented verification boundaries are in the README at the same version. This website audit is not a fresh CI run of every project.