security: fix critical webhook direct upgrade path, seed auth, CORS Vary header

Browse Source

- Webhook polar/route: block direct ?userId=&tier= upgrades in production (NODE_ENV guard)
- Seed route: require ADMIN_SECRET via x-admin-secret header
- Feedback route: require FEEDBACK_ADMIN_TOKEN env var in production
- CORS middleware: add Vary: Origin header for caching correctness
- MOCK_PAYMENTS: add NODE_ENV production guard
- Wallet top-up: add production guard for mock mode when POLAR_ACCESS_TOKEN unset

...

This commit is contained in:

Pi Agent

2026-06-28 01:15:45 +08:00

parent 0c3521ba4c

commit de48918acf

10 changed files with 541 additions and 15 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

prisma/prisma/dev.db

BIN

Binary file not shown.