Secred in separate file, desing improvements

README.md

@@ -5,8 +5,8 @@ A small static webpage for saving and sharing Google Maps route links.
 ## Features
 
 - Add routes with name and Google Maps link (mandatory)
-- Optional date, description, and picture URL
-- Click route names or **Open map** to open saved Google Maps links
+- Optional date, description, and uploaded picture
+- Click route names to open saved Google Maps links
 - Edit, remove, share, or copy route links
 - Data is stored locally in the browser with `localStorage`
 - Simple secret gate before the app opens
@@ -15,4 +15,14 @@ Open `index.html` in a browser to use it.
 
 ## Secret
 
-The current demo secret is `change-me`. Before publishing, replace `AUTH_SECRET` in `app.js` with your real secret. This is a simple client-side gate, not strong server-side security.
+Create `config.js` from the example and set your secret there:
+
+```sh
+cp config.example.js config.js
+```
+
+```js
+window.ROUTES_SECRET = "your-secret";
+```
+
+`config.js` is gitignored. This is a simple client-side gate, not strong server-side security.