DonutHelperNow

v1.8.3 — Vulnerability Update

Security Fixes

• Hardcoded Admin Users — Admin usernames are now read from ADMIN_USERS environment variable instead of being hardcoded in source.
• Admin Token System — Admin tokens are now HMAC-signed with expiry (1 hour) instead of being plaintext username:code pairs.
• Admin Code Endpoint — GET /admin/get-code now requires an existing admin session (was publicly accessible without auth).
• User Authentication — All user-facing API endpoints (friends, chat, money, party) now require a valid session token. Tokens are issued on register/heartbeat with 24-hour expiry.
• CORS Policy — Access-Control-Allow-Origin is now configurable via CORS_ORIGINS environment variable (defaults to * for backward compatibility).
• Rate Limiting — Added rate limiting on sensitive endpoints (auth, admin login, money operations) to prevent brute-force and abuse.
• API URL Default — Removed hardcoded server IP from mod source; default URL is now configurable.