This website requires JavaScript.
526a649c8b
Say what bets and withdrawals actually exclude (B-70)
davide and Claude Opus 5
2026-08-04 16:16:13 +02:00
666cb1a0c9
Retire in-code comments that outlived what they described (B-69)
davide and Claude Opus 5
2026-08-04 16:00:57 +02:00
162ceed40f
Describe the code the docs actually ship with (B-68)
davide and Claude Opus 5
2026-08-04 14:33:32 +02:00
5f6abe5b32
Validate and bound the QR endpoint (B-67)
davide and Claude Opus 5
2026-08-04 14:18:22 +02:00
23d58796b6
Refuse to open a round that could not pay its winner (B-66)
davide and Claude Opus 5
2026-08-04 14:13:00 +02:00
c4b2dc3ea2
Advertise the jackpot that will actually be paid (B-65)
davide and Claude Opus 5
2026-08-04 11:52:10 +02:00
c0314e2bf0
Never swap the tip's hash sideways, and never split it from its height (B-64)
davide and Claude Opus 5
2026-08-04 10:29:37 +02:00
8a0ebecfcc
Never let a draw be seeded by a block that predates the close (B-63)
davide and Claude Opus 5
2026-08-04 10:01:21 +02:00
8dd913ec59
Always keep a change output, so every tx stays fee-bumpable (B-62)
davide and Claude Opus 5
2026-08-03 23:36:55 +02:00
37cc5eeeb5
Snapshot a round's timing when it opens (B-61)
davide and Claude Opus 5
2026-08-03 23:25:56 +02:00
77e07e87dc
Audit-log bug report status changes (B-60)
davide and Claude Opus 5
2026-08-03 22:59:00 +02:00
6246b13247
Corroborate deposit credits, not just external spends (B-59)
davide and Claude Opus 5
2026-08-03 22:40:15 +02:00
0aac73e557
Bound registrations with a per-IP quota instead of failure backoff (B-58)
davide and Claude Opus 5
2026-08-03 22:32:20 +02:00
57721355f0
Make usernames one case-insensitive namespace (B-57)
davide and Claude Opus 5
2026-08-03 22:27:15 +02:00
ab65728bdc
Bound the rate limiter's bucket dict (B-56)
davide and Claude Opus 5
2026-08-03 22:22:51 +02:00
9c7befe595
Hash and verify passwords off the event loop (B-55)
davide and Claude Opus 5
2026-08-03 22:18:33 +02:00
421fe72a8b
Record B-54's fixing commit in BUGS.md
davide and Claude Opus 5
2026-08-03 22:14:03 +02:00
907e32e9e0
Make X-Forwarded-For trustworthy instead of attacker-controlled (B-54)
davide and Claude Opus 5
2026-08-03 22:14:03 +02:00
8f3cdcb2f8
Record B-53's fixing commit in BUGS.md
davide and Claude Opus 5
2026-08-03 22:06:29 +02:00
64f62291d2
Close the window where a bet pays into a round it was left out of (B-53)
davide and Claude Opus 5
2026-08-03 22:06:21 +02:00
025754c860
Cap participants per round and give the payout its own input limit (B-52)
davide and Claude Opus 5
2026-08-03 16:21:33 +02:00
99d7a1ee00
Open the 2026-08-03 audit list (B-52 … B-72)
davide and Claude Opus 5
2026-08-03 15:51:00 +02:00
e5af15087c
Polish /report-bug's visual design and refine bug report semantics
davide and Claude Sonnet 5
2026-07-31 16:28:37 +02:00
a384b08044
Translate /report-bug into all 7 languages, require English in the report itself
davide and Claude Sonnet 5
2026-07-31 16:03:38 +02:00
ee4e845c89
Add user bug reporting with admin triage (open/read/resolved)
davide and Claude Sonnet 5
2026-07-31 15:50:40 +02:00
977bb762c7
Deduplicate the 70/30 prize split formula
davide and Claude Sonnet 5
2026-07-31 15:04:33 +02:00
fe909bedcf
Don't double-count a bet/withdrawal's own change in pending balance (B-51)
davide and Claude Sonnet 5
2026-07-31 15:03:53 +02:00
9207bbcb8f
Don't reveal the win banner before winner_amount_sats is known (B-50)
davide and Claude Sonnet 5
2026-07-31 15:03:42 +02:00
5cfe2d6f95
Merge audit-2026-07-27: fix all 25 findings of the second audit
davide
2026-07-27 23:37:12 +02:00
0d2fef6502
Delete BUGS.md now that both audits' findings are closed
davide
2026-07-27 23:37:02 +02:00
e7f844b11f
Publish an SSE update from the bet/withdrawal rollback paths (B-49)
davide
2026-07-27 23:35:10 +02:00
4c80c1c5bf
Cap the number of inputs a transaction may spend (B-48)
davide
2026-07-27 23:30:06 +02:00
6a90136b50
Widen raw_tx_hex and payload_json from String to Text (B-47)
davide and Claude Sonnet 5
2026-07-27 16:24:05 +02:00
31bc9a327f
Compare admin token as UTF-8 bytes to avoid TypeError on non-ASCII input (B-46)
davide and Claude Sonnet 5
2026-07-27 16:17:40 +02:00
6045c89ed0
Bound admin list endpoint limits, add status filter to pending-transactions (B-45)
davide and Claude Sonnet 5
2026-07-27 16:10:53 +02:00
a574db0d93
Align README and running-the-server.md with the Docker-only policy (B-44)
davide and Claude Sonnet 5
2026-07-27 16:04:24 +02:00
d60da11603
Add baseline HTTP security headers in Caddy (B-43)
davide and Claude Sonnet 5
2026-07-27 15:44:47 +02:00
22e3cfb2be
Disable Swagger/ReDoc/OpenAPI JSON by default (B-42)
davide and Claude Sonnet 5
2026-07-27 15:34:49 +02:00
4124dc08e6
Check confirmation/existence via scripthash history, not verbose replies (B-41)
davide
2026-07-27 15:27:58 +02:00
08c566d547
Restructure bump_fee into three phases, drop float fee math (B-40)
davide
2026-07-27 15:14:58 +02:00
97545ad91f
Run SQLite in WAL mode with a busy_timeout (B-39)
davide
2026-07-27 14:53:22 +02:00
702b37b319
Cap SSE subscribers per client IP instead of only globally (B-38)
davide
2026-07-27 14:44:15 +02:00
0b44fe632e
Distinguish a pending-only balance from a truly insufficient one (B-37)
davide and Claude Sonnet 5
2026-07-27 14:23:00 +02:00
7fa26df104
Make a stalled draw wait observable (B-36)
davide and Claude Sonnet 5
2026-07-27 14:12:27 +02:00
bb8b71278a
Stamp UTC on naive API timestamps before serializing (B-35)
davide and Claude Sonnet 5
2026-07-27 12:20:22 +02:00
739fc9fed2
Invalidate existing sessions on password change/reset (B-34)
davide and Claude Sonnet 5
2026-07-27 12:02:23 +02:00
16802cafb6
Throttle login and registration with exponential backoff (B-33)
davide and Claude Sonnet 5
2026-07-27 11:51:26 +02:00
17c557b8a3
Meet BIP125's relay minimum on every RBF bump, and cap the fee rate (B-32)
davide
2026-07-27 11:16:20 +02:00
fe5639a037
Update CLAUDE.md
davide
2026-07-27 11:05:53 +02:00
12df04178e
Resubscribe concurrently and in the background on reconnect (B-31)
davide
2026-07-27 10:44:23 +02:00
63df38d30b
Add a periodic deposit reconciler, and stop losing subscribe tasks (B-30)
davide
2026-07-27 10:35:23 +02:00
e8fdea0389
Corroborate an external spend before marking a UTXO gone (B-29)
davide
2026-07-27 10:25:07 +02:00
0ce0562fd7
Validate Electrum headers and corroborate the draw's block (B-28)
davide
2026-07-27 10:07:21 +02:00
7224ca0e66
Shorten the fixed B-25/26/27 entries in BUGS.md
davide
2026-07-27 09:42:24 +02:00
933760e948
Decouple the RBF abandon clock from the bump clock (B-27)
davide and Claude Sonnet 5
2026-07-27 09:39:38 +02:00
50a43ae3ca
Retry a stuck payout automatically, and log every failure (B-26)
davide and Claude Sonnet 5
2026-07-27 09:29:14 +02:00
f13f6850b7
Persist the payout before broadcasting it (B-25)
davide and Claude Sonnet 5
2026-07-27 09:19:53 +02:00
43d2321e0f
Record the 25 open findings of the 2026-07-27 audit
davide and Claude Opus 5
2026-07-27 09:02:34 +02:00
f1a1145cda
Detect UTXOs spent outside the platform and correct the cached balance
davide and Claude Sonnet 5
2026-07-27 08:45:09 +02:00
447bbba83e
Add placeholder guide/bug-report pages, and an exclamation-mark bug icon
davide and Claude Sonnet 5
2026-07-27 08:35:47 +02:00
f9f822f437
Document real fallback Electrum servers in .env.example
davide
2026-07-27 08:21:12 +02:00
845ba98409
Record the audit outcome and the architecture it changed
davide and Claude Opus 5
2026-07-27 00:35:28 +02:00
dc4d5761df
Format amounts, guard the loading state, and translate the new errors
davide and Claude Opus 5
2026-07-27 00:35:14 +02:00
7c4e9983ea
Survive a dropped Electrum connection, and fall back to other servers
davide and Claude Opus 5
2026-07-27 00:34:59 +02:00
25f4a1c6b6
Refuse to start half-configured, and keep failures machine-readable
davide and Claude Opus 5
2026-07-27 00:34:33 +02:00
85dce221c5
Validate admin config and registration input, and log config changes
davide and Claude Opus 5
2026-07-27 00:32:48 +02:00
daf66fd6bc
Fix the round-open race, the advertised jackpot, and payout error handling
davide and Claude Opus 5
2026-07-27 00:32:22 +02:00
b4d70385a6
Leave dust-sized change to the fee instead of creating it
davide and Claude Opus 5
2026-07-27 00:31:41 +02:00
d528c5b475
Let the system recover from a broadcast that never confirms
davide and Claude Opus 5
2026-07-27 00:31:24 +02:00
cc88763a9d
Make "one active round" a DB invariant and record why a tx failed
davide and Claude Opus 5
2026-07-27 00:30:48 +02:00
9b6a4a240c
Give every BUGS.md entry an explicit fix and regression test
davide and Claude Opus 5
2026-07-26 22:14:52 +02:00
fb734bb818
Document the 24 bugs found in the full-codebase audit
davide and Claude Opus 5
2026-07-26 22:10:50 +02:00
d4e0974881
Let JS own the live status labels instead of sharing them with data-i18n
davide and Claude Opus 5
2026-07-26 21:55:37 +02:00
28c1179e9b
Recover from expired sessions and malformed requests in the dashboard
davide and Claude Opus 5
2026-07-26 21:54:56 +02:00
5c9ccc0344
Reject withdrawal addresses that aren't PLM
davide and Claude Opus 5
2026-07-26 21:45:07 +02:00
0cf35147ad
Answer user-facing API failures with a machine-readable error code
davide and Claude Opus 5
2026-07-26 21:44:39 +02:00
7048fe7ea6
Translate the user-facing dashboard into 7 languages
davide and Claude Opus 5
2026-07-26 21:43:35 +02:00
8a3dfd4592
Replace flowchart.mmd with per-topic diagrams and a print pipeline
davide
2026-07-23 16:24:28 +02:00
bae08f2759
Extract inline JS from index.html/admin.html into app.js/admin.js
davide and Claude Sonnet 5
2026-07-23 11:05:38 +02:00
aae0961c94
Bring docs in sync with recent features (pending balance, SSE, per-player reveal)
davide and Claude Sonnet 5
2026-07-23 11:05:27 +02:00
dda5bd14e1
Wire up the SSE push channel in both frontend dashboards
davide and Claude Sonnet 5
2026-07-23 10:52:50 +02:00
f229f91632
Add server-push (SSE) notifications for round/bet/balance state changes
davide and Claude Sonnet 5
2026-07-23 10:52:07 +02:00
6a857f0e07
Show pending-inclusive balance and per-player round outcome reliably
davide and Claude Sonnet 5
2026-07-23 10:09:12 +02:00
f822911128
Fix frontend/server round-state desync bugs
davide
2026-07-23 08:53:23 +02:00
ad71000777
Show a distinct message per round phase instead of one generic spinner
davide
2026-07-22 23:21:04 +02:00
877a219aa4
Distinguish round-closing sub-phases and anchor cooldown to payout confirmation
davide
2026-07-22 23:20:55 +02:00
3d6f4a98c4
Extract inline CSS from index.html/admin.html into style.css/admin.css
davide
2026-07-22 23:20:40 +02:00
7b3555f8eb
Tie the withdrawal minimum to the bet amount instead of a separate field
davide and Claude Sonnet 5
2026-07-22 19:25:15 +02:00
6c51a81f0e
Fail loud at startup if the master key is missing
davide and Claude Sonnet 5
2026-07-22 18:46:19 +02:00
d92ef9ed9f
Drop DATABASE_URL/MASTER_KEY_PATH from .env.example
davide and Claude Sonnet 5
2026-07-22 18:26:52 +02:00
1941f30b10
Add ops scripts to decrypt/re-encrypt the master xprv, and document them
davide and Claude Sonnet 5
2026-07-22 16:20:03 +02:00
9e7b726df7
Use the official PLM logo in the navbar and as favicon
davide and Claude Sonnet 5
2026-07-22 15:39:47 +02:00
5f62a8315e
Add a "withdraw full balance" checkbox to the withdrawal form
davide and Claude Sonnet 5
2026-07-22 14:59:02 +02:00
80c413ad3d
Show the net prize as the jackpot instead of the gross pool
davide and Claude Sonnet 5
2026-07-22 14:53:09 +02:00
1acb6c3b16
Redesign the user dashboard with a modern fintech-style layout
davide and Claude Sonnet 5
2026-07-22 14:50:17 +02:00
2b645f5e37
Show the user's balance in the navbar
davide and Claude Sonnet 5
2026-07-22 14:36:30 +02:00
c4f6f2eed7
Add a help link and bug-report button to the user navbar
davide and Claude Sonnet 5
2026-07-22 14:34:03 +02:00
67f70465e9
Warn users that withdrawals only support P2WPKH bech32 addresses
davide and Claude Sonnet 5
2026-07-22 14:29:05 +02:00
9fa7eec378
Document the three sequential block confirmations behind the draw/payout timing
davide and Claude Sonnet 5
2026-07-22 14:14:09 +02:00
7dcf6d2756
Sync round countdown across clients and enforce the bet cutoff on deadline, not scheduler tick
davide and Claude Sonnet 5
2026-07-22 14:07:09 +02:00
davideandClaude Opus 5