Closes #25. **Rate limits, keyed on the visitor rather than the proxy.** The embed page and the API both read the disk on every request, and nothing capped either. `middlewares/rateLimits.ts` on `express-rate-limit`: - The public embed page: 300 a minute per visitor. - The API: **only failures count**, 60 a minute, and the limit runs before the token check so a wrong guess is one. A batch publish of short clips over a LAN is several good requests a second, and a ceiling on those would eventually refuse the owner. - `/media` is not limited: a video that seeks is a burst of Range requests, and the edge answers most of them. The key is `CF-Connecting-IP`, then the first `X-Forwarded-For` hop, then the socket. This runs behind a reverse proxy, so `req.ip` is the proxy for every request and a limit keyed on it would be one bucket for the whole internet. Forging either header buys a fresh bucket, which is no worse than no limit, and never gets anybody in. **The bearer header is read by hand.** `/^Bearer\s+(.+)$/` let `\s+` and `.+` fight over the same spaces, quadratic on the one header anybody on the internet can send. A test holds the new parse under 100 ms on 200,000 spaces. **Two log lines no longer use the filename as a format string.** A `%s` in an uploaded name would have been read as a directive. Gates: `tests/unit/publisher`, 12 new cases. `publisher-views-check.mjs` gained three checks (the 61st wrong guess is a 429, another visitor still gets in, 80 good requests in a row are all answered), 20 in all, exit 0. `discord-webhook-check.mjs` exit 0. `npm run check`: 689 tests. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Commits

Commits on Sep 22, 2026

fix(security): the publisher code scanning alerts