PubTrivia's WebSocket server limits open HTTP routes to a basic health check

PubTrivia runs a separate long-lived Node process that holds WebSocket connections for its quiz sessions, and it exposes three HTTP routes plus a catch-all 404. The public /health route returns only liveness data: a status flag, the number of active sessions and connected clients, and whether Redis fan-out is enabled. A second route, /internal/stats, lists every live session with its player count, so the author required a shared secret for it, since aggregating that list is more sensitive than any single session ID. Requests without the correct secret receive a 401 response, and unknown paths return a 404. The author notes the secret comparison checks lengths before using a constant-time comparison, because that function throws on mismatched lengths.