The sign-in page is served by Logto, not the SaaS app. Referencing /platform/favicon.svg required SecurityConfig permitAll and cross-service routing. Instead, bundle favicon.svg directly in the sign-in UI dist so Logto serves it at /favicon.svg. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>