Skip to content

Security Fixes & Some Speedup - #130

Merged
listixx merged 4 commits into
Xittered:mainfrom
thororen1234:fixes
Oct 24, 2026
Merged

listixx merged 4 commits into
Xittered:mainfrom
thororen1234:fixes

Conversation

@thororen1234

Copy link
Copy Markdown
Contributor

No description provided.

thororen1234 and others added 4 commits October 24, 2026 09:11
The mobile app signs in with OAuth, so blocking every /money route for app
tokens broke its wallet. Apps reach Equicoins as far as their scope goes
again, and the consent page now lists them (see for read, send and request
for write) when the instance has them on.

A peer's moved balances were held to one full move a day. Anything past that
waits on 429 and the sender gives up after 3 days, refunding the old (often
deactivated) account, so an instance closing down lost most of its people's
balances. The allowance is now 20 full moves a day. An account that already
moved is answered 403 before the allowance is checked, so it isn't retried
for 3 days for nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01HxQUN8gmDL6hTPMe44YMxN
@listixx
listixx merged commit 383a84d into Xittered:main Oct 24, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants