| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | auth: fail closed on adminpass, scrub sample secrets (S3) | Adam Soltys | 2026-08-07 | 1 | -4/+13 |
| | | | | | | | | | | | | | | | | | The master-password path (isAdmin = password === config.adminpass) logs in as any user, skipping password, 2FA, and captcha. Worse, when adminpass is unset an omitted password field made undefined === undefined true, authenticating as anyone. Require both the configured value and the supplied password to be non-empty and match exactly, across every adminpass comparison (login, recaptcha bypass, support email, freeze). Also scrub config.ts.sample: the sample shipped a working-looking JWT secret, two server nsec keys, and adminpass "pwa". Replace with fail-closed placeholders and regenerate instructions. Rotate any deployment that ever shipped the sample values. Co-Authored-By: Claude Opus 4.8 <[email protected]> | ||||
| * | rotate server key | Adam Soltys | 2025-09-29 | 1 | -0/+1 |
| | | |||||
| * | catch errors in pay_invoice | Adam Soltys | 2025-09-29 | 1 | -1/+1 |
| | | |||||
| * | clb socket | Adam Soltys | 2025-08-21 | 1 | -0/+1 |
| | | |||||
| * | square env | Adam Soltys | 2025-08-21 | 1 | -0/+2 |
| | | |||||
| * | square sample config | Adam Soltys | 2025-08-21 | 1 | -0/+6 |
| | | |||||
| * | Initial server setup fixes | ndungudedan | 2024-10-02 | 1 | -1/+1 |
| | | |||||
| * | rm jimp | Adam Soltys | 2024-09-08 | 1 | -2/+2 |
| | | |||||
| * | add mint to sample config | Adam Soltys | 2024-09-05 | 1 | -0/+1 |
| | | |||||
| * | update sample config | Adam Soltys | 2024-09-05 | 1 | -2/+3 |
| | | |||||
| * | fx endpoint | Adam Soltys | 2024-09-04 | 1 | -0/+35 |
 |
index : coinos-server.git | |
| coinos server — legacy coinos.io backend (Lightning, on-chain, Liquid) | coinos |
| aboutsummaryrefslogtreecommitdiffstats |
path: root/config.ts.sample