Update app.py

app.py

@@ -281,6 +281,12 @@ Use the checkboxes below to configure a specific single test.
 * **Windows Mode:** Uses PowerShell payload (`powershell -c ...`).
 * **Generic WAF Bypass:** Pads the request with junk data (128KB).
 * **Vercel WAF Bypass:** Uses a specific multipart structure.
+
+### 🛣️ Custom Path (When to use it)
+Required if the root URL (`/`) is static or fails to trigger the exploit.
+* **Sub-directories:** If the app lives at `/dashboard`, `/app`, or `/portal`.
+* **Dynamic Routes:** If the homepage is static, try pages with forms/logic like `/login`, `/auth`, or `/search`.
+* **Internals:** Direct targeting of `/_next` or `/api` can sometimes bypass caching.
 """
 
 with gr.Blocks(title="React2Shell Scanner") as demo: