Anyone can edit/delete pastes even though MICROBIN_PASSWORD is set and EDITABLE is false

[fcpwiz]

Title says it all! Only people with the password can submit pastes, but anyone with the URL can edit and delete it without needing a password. What am I missing here?

[skyrocknroll]

Facing the same issue

[Danie10]

I tested the public instance with a read-only code snippet which I set a password for. Although I see an edit button, if I don't enter a password, it does not save any changes. Same happened when I tried to remove the code snippet without a password. So it looked to me like it is working as intended?

That said, I tried hosting it myself and could edit, but not delete (does not accept password) - see another issue open for that. Wish I could see the config for the public test instance as it seemed to work OK.

If it helps, these are the relevant envs I finally found to work (some variable descriptions make little sense):

export MICROBIN_EDITABLE=true
export MICROBIN_READONLY=false
export MICROBIN_ENABLE_READONLY=true
export MICROBIN_NO_FILE_UPLOAD=false
export MICROBIN_UPLOADER_PASSWORD=ISetOneHere