pi-agent de48918acf security: fix critical webhook direct upgrade path, seed auth, CORS Vary header ...

- Webhook polar/route: block direct ?userId=&tier= upgrades in production (NODE_ENV guard)
- Seed route: require ADMIN_SECRET via x-admin-secret header
- Feedback route: require FEEDBACK_ADMIN_TOKEN env var in production
- CORS middleware: add Vary: Origin header for caching correctness
- MOCK_PAYMENTS: add NODE_ENV production guard
- Wallet top-up: add production guard for mock mode when POLAR_ACCESS_TOKEN unset

2026-06-28 01:15:45 +08:00

..

ci.yml

security: fix critical webhook direct upgrade path, seed auth, CORS Vary header

2026-06-28 01:15:45 +08:00