YoursFunny 4c1fa857c4 fix(webhook): refuse to start without a secret token ...

Webhook mode passed the secret token to the axum listener only when WEBHOOK_SECRET_TOKEN was set, and docker-compose defaults it to empty (an empty string counts as unset) — the default deployment therefore ran its listener on a public port with no check on X-Telegram-Bot-Api-Secret-Token, so anyone could POST forged updates and impersonate admins (/bot_dict, /clear_cache, /test). Startup now fails when webhook mode has no secret; .env.example and AGENTS.md spell out the requirement.

2026-09-24 00:48:21 +08:00

..

x-media

feat(pixiv): fall back to the large variant when a page has no original

2026-09-21 20:29:48 +08:00

xmedia-bot

fix(webhook): refuse to start without a secret token

2026-09-24 00:48:21 +08:00