Security context

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

src/routes/log.ts: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

SQL Injection: Two separate fixes were needed for SQL injection in the same log route, indicating incomplete parameter handling. The first fixed type coercion for page/max, the second fixed escaping for hash, but other parameters (e.g., id, other filters) may still be vulnerable if not consistently validated.

Auth Bypass: Authentication for debug routes has been changed twice: first adding JWT middleware, then replacing JWT with signed requests. This churn indicates the auth model is unstable and may have gaps, especially if any debug route bypasses the middleware or if the replacement is incomplete.

Denial of Service: Three DoS fixes target different resource exhaustion vectors: external axios requests, in-memory filtersMap, and transaction rate limiting. The filtersMap and axios limits are separate but both involve unbounded growth; the transaction rate limit addresses abuse but may need to be extended to other endpoints.