1 Commits

Author	SHA1	Message	Date
pi-agent	de48918acf	security: fix critical webhook direct upgrade path, seed auth, CORS Vary header ... - Webhook polar/route: block direct ?userId=&tier= upgrades in production (NODE_ENV guard) - Seed route: require ADMIN_SECRET via x-admin-secret header - Feedback route: require FEEDBACK_ADMIN_TOKEN env var in production - CORS middleware: add Vary: Origin header for caching correctness - MOCK_PAYMENTS: add NODE_ENV production guard - Wallet top-up: add production guard for mock mode when POLAR_ACCESS_TOKEN unset	2026-06-28 01:15:45 +08:00