davideandClaude Sonnet 5 31bc9a327f Compare admin token as UTF-8 bytes to avoid TypeError on non-ASCII input (B-46) ...

secrets.compare_digest raises TypeError instead of returning False when a
str argument contains non-ASCII characters, turning a bad admin token into
an unhandled 500 instead of the expected 403. Encode both sides before
comparing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-27 16:17:40 +02:00

..

api

Compare admin token as UTF-8 bytes to avoid TypeError on non-ASCII input (B-46)

2026-07-27 16:17:40 +02:00

audit

Add admin config and audit log

2026-07-21 10:26:31 +02:00

auth

Cap SSE subscribers per client IP instead of only globally (B-38)

2026-07-27 14:44:15 +02:00

bets

Let the system recover from a broadcast that never confirms

2026-07-27 00:31:24 +02:00

db

Run SQLite in WAL mode with a busy_timeout (B-39)

2026-07-27 14:53:22 +02:00

deposits

Add a periodic deposit reconciler, and stop losing subscribe tasks (B-30)

2026-07-27 10:35:23 +02:00

electrum

Check confirmation/existence via scripthash history, not verbose replies (B-41)

2026-07-27 15:27:58 +02:00

rounds

Cap SSE subscribers per client IP instead of only globally (B-38)

2026-07-27 14:44:15 +02:00

static

Distinguish a pending-only balance from a truly insufficient one (B-37)

2026-07-27 14:23:00 +02:00

tx

Check confirmation/existence via scripthash history, not verbose replies (B-41)

2026-07-27 15:27:58 +02:00

wallet

Meet BIP125's relay minimum on every RBF bump, and cap the fee rate (B-32)

2026-07-27 11:16:20 +02:00

withdrawals

Distinguish a pending-only balance from a truly insufficient one (B-37)

2026-07-27 14:23:00 +02:00

__init__.py

Scaffold project layout, DB schema and settings

2026-07-21 10:25:23 +02:00

config.py

Disable Swagger/ReDoc/OpenAPI JSON by default (B-42)

2026-07-27 15:34:49 +02:00

logging_config.py

Log to a file instead of only stdout

2026-07-21 10:46:47 +02:00

main.py

Disable Swagger/ReDoc/OpenAPI JSON by default (B-42)

2026-07-27 15:34:49 +02:00