id: BB-RESEARCH-8E648DD8
type: research
title: Public web customization constraints
Public web customization constraints
Findings
Paperless supports official title and logo configuration.
Vaultwarden supports runtime SCSS, but its CSP required inlined palette and logo data rather than cross-origin theme imports.
The investigated Actual, Dawarich, and zot versions exposed no adequate runtime theme hook for the observed defects.
HallucyGenie can expose a branded public root while protecting application paths.
Exact hashed Caddy overrides safely fall through to upstream after hash changes, but silently lose the local fix.
A captured Vaultwarden root shell can become incompatible after an automatic image update.
These findings are version-bound.
Implementation assets and Caddy routes remain the current operational source.
Provenance
Migrated from the 2026-06-18 Nugu site inventory and reconciled with current assets, Quadlets, Caddy routes, and Chrome verifier coverage.
Ephemeral screenshots, pass tables, exact hashes, and the obsolete site inventory were discarded.
---
id: BB-RESEARCH-8E648DD8
type: research
title: Public web customization constraints
---
# Public web customization constraints
## Findings
- Paperless supports official title and logo configuration.
- Vaultwarden supports runtime SCSS, but its CSP required inlined palette and logo data rather than cross-origin theme imports.
- The investigated Actual, Dawarich, and zot versions exposed no adequate runtime theme hook for the observed defects.
- HallucyGenie can expose a branded public root while protecting application paths.
- Exact hashed Caddy overrides safely fall through to upstream after hash changes, but silently lose the local fix.
- A captured Vaultwarden root shell can become incompatible after an automatic image update.
These findings are version-bound.
Implementation assets and Caddy routes remain the current operational source.
## Provenance
Migrated from the 2026-06-18 Nugu site inventory and reconciled with current assets, Quadlets, Caddy routes, and Chrome verifier coverage.
Ephemeral screenshots, pass tables, exact hashes, and the obsolete site inventory were discarded.