Redirects stay on Kumir

redirectFromSearch only allows same-origin paths. Default return is home.

redirect_to and next must start with a single slash. Protocol-relative, external, and @-host tricks fall back to /.

Native Get started always opens the in-app home after a verified create.