diff --git a/framework/lib/path.ts b/framework/lib/path.ts
index 846d5580d6063f66cd29f4925c0d3e0a8ff710d4..d6fd2dded098765ec9688870b17eb36668a6675c 100644
--- a/framework/lib/path.ts
+++ b/framework/lib/path.ts
@@ -193,6 +193,10 @@ export class Path {
     await fs.writeFile(this.raw, JSON.stringify(json));
   }
 
+  async writeMkdir(text: string) {
+    await fs.writeMkdir(this.raw, text);
+  }
+
   static sep = path.sep;
 
   [Symbol.for("nodejs.util.inspect.custom")](
diff --git a/src/backend-extra.ts b/src/backend-extra.ts
new file mode 100644
index 0000000000000000000000000000000000000000..114fad8f354a98db0e30a9eb1f53b1e3463da0ad
--- /dev/null
+++ b/src/backend-extra.ts
@@ -0,0 +1,24 @@
+export const app = new Hono();
+
+app.get("/extra/secret-message", async (c) => {
+  const { key } = c.req.query();
+  if (!key || !key.match(/^[a-z0-9]+$/)) {
+    return c.text("400 bad request", { status: 400 });
+  }
+  const text = await Path.resolve(".clover/secret-message", key)
+    .readIfExists("utf-8");
+  if (text) return c.text(text);
+  return c.text("401 not authorized", { status: 401 });
+});
+app.post("/admin/extra/secret-message", async (c) => {
+  const key = c.req.query("key");
+  if (!key || !key.match(/^[a-z0-9]$/)) {
+    return c.text("400 bad request", { status: 400 });
+  }
+  await Path.resolve(".clover/secret-message", key)
+    .writeMkdir(await c.req.text());
+  return c.text("ok", { status: 200 });
+});
+
+import { Path } from "#sitegen/path";
+import { Hono } from "hono";
diff --git a/src/backend.ts b/src/backend.ts
index a9bca66d19e4c47047a9e732886890e0c978cb77..5083775bbcf2ddf638ff4e2386688076555d5467 100644
--- a/src/backend.ts
+++ b/src/backend.ts
@@ -12,6 +12,7 @@ app.use(admin.middleware);
 app.route("", require("./q+a/backend.ts").app);
 app.route("", require("./file-viewer/backend.tsx").app);
 app.route("", require("./friend-auth.ts").app);
+app.route("", require("./backend-extra.ts").app);
 
 // Asset middleware has least precedence
 app.use(assets.middleware);