fix: address phase 1 audit findings (xss, cors, dead code)

2026-08-11 03:58:58 +00:00 · 2026-04-25 16:08:12 +02:00
parent 01bc95e176
commit 77ffda3e42
3 changed files with 29 additions and 40 deletions
@@ -23,7 +23,7 @@ const httpServer = createServer(app);
 // Socket.IO setup with security constraints
 const io = new Server(httpServer, {
    cors: {
-        origin: "*",
+        origin: ["https://koalasync.shik3i.net"],
        methods: ["GET", "POST"]
    },
    maxHttpBufferSize: 1024, // 1KB max per message