fix(audit): S-001 webhook leak, S-003 payment gate, Dockerfile CMD malformation#195

Merged

Timwal78 merged 9 commits into

mainfrom

claude/scriptmaster-labs-audit-bltwof

Jun 19, 2026

Commits on Jun 19, 2026

fix(security): remove hardcoded Discord webhook URL from render.yaml + fix Dockerfile CMD
Timwal78
committed
fix(S-003): payment gate now fails closed on 402Proof outage
claude
committed
docs(agents): rewrite llms.txt with accurate 35-tool MCP manifest
claude
committed
security: harden headers, CORS, rate limiting, Dockerfile, symbol validation
claude
committed
feat(ops): add proactive service health monitor with Discord alerting
claude
committed
security: remove hardcoded Neynar/Render API keys from tipmaster workflow + pin all actions to SHA
Timwal78
committed
security: pin GitHub Actions to SHA (agent, build-android, ci, publish-npm, publish-pypi, sml-agent)
Timwal78
committed
security: SHA-pin remaining workflow actions (stellar-forge, submit, sync, uptime, xdeo-*, service-monitor)
Timwal78
committed
fix(ci): correct actions/setup-node SHA from invalid cdca7d6 to verified 49933ea
claude
committed