DorianandClaude Opus 4.6 0131949643 fix: harden SSRF protection and add comprehensive tests ...

Fix gaps in isAllowedWebhookUrl: IPv6 bracket stripping for [::1],
[fe80::], [::ffff:7f00:1]; block 0.0.0.0 and [::] (IPv6 all-zeros);
handle URL-parser normalized ::ffff:7fxx IPv6-mapped localhost.

Add 20 SSRF test cases covering: file://, gopher://, data: schemes,
localhost, 127.0.0.1, 10.x, 172.16-31.x, 192.168.x, IPv6 ::1,
fe80::, fc00::/fd00::, octal/decimal IP bypass, metadata IP
169.254.169.254, .localhost TLD, overly long URLs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-13 09:21:16 +00:00

.claude

feat: SSE live fight spectating with spectator count

2026-03-08 19:46:39 +00:00

.github/workflows

test: add test infrastructure for frontend and server

2026-03-12 22:30:43 +00:00

bot

feat: full comedy overhaul — voices, narrations, trash talk, commentary

2026-03-07 09:15:41 +00:00

docs

security: redact hidden retro combos from all public docs

2026-03-08 14:54:54 +00:00

e2e

test: E2E specs for signup, fight replay, and leaderboard flows

2026-03-13 05:15:46 +00:00

examples/python-bot

security: redact hidden retro combos from all public docs

2026-03-08 14:54:54 +00:00

frontend

chore: pin all dependency versions for reproducible builds

2026-03-13 06:21:16 +00:00

loops

feat: retro mode — arcade combo round with gamepad overlays

2026-03-08 14:13:47 +00:00

server

fix: harden SSRF protection and add comprehensive tests

2026-03-13 09:21:16 +00:00

.dockerignore

test: Docker build and PWA installation verified

2026-03-09 00:38:31 +00:00

.gitignore

chore: harden .gitignore for secrets and credentials

2026-03-09 07:33:56 +00:00

BOT_SETUP.md

security: redact hidden retro combos from all public docs

2026-03-08 14:54:54 +00:00

botfights.db

feat: SSE live fight spectating with spectator count

2026-03-08 19:46:39 +00:00

BOTFIGHTS.md

fixes

2026-03-12 16:35:59 +00:00

CLAUDE.md

feat: v5 — boxing poster fight cards, 12-char names, diverse mock bots

2026-03-08 10:33:30 +00:00

deploy.sh

feat: VPS deploy script + Tor hidden service config

2026-03-08 00:29:18 +00:00

docker-compose.tor.yml

feat: VPS deploy script + Tor hidden service config

2026-03-08 00:29:18 +00:00

docker-compose.yml

fix: add cache-bust build arg to force Docker rebuild on deploy

2026-03-09 08:38:02 +00:00

Dockerfile

fix: add cache-bust build arg to force Docker rebuild on deploy

2026-03-09 08:38:02 +00:00

eslint.config.js

feat: add eslint-plugin-security rules for static analysis

2026-03-13 05:26:10 +00:00

nostr-login-implementation.md

chore: add PromptDifficulty type and nostr login planning doc

2026-03-09 14:26:43 +00:00

package.json

chore: pin all dependency versions for reproducible builds

2026-03-13 06:21:16 +00:00

PLAN.md

feat: betting system — Cashu escrow, Lightning deposit/withdraw, payouts

2026-03-08 00:33:08 +00:00

pnpm-lock.yaml

chore: pin all dependency versions for reproducible builds

2026-03-13 06:21:16 +00:00

pnpm-workspace.yaml

fix: move dependency overrides to pnpm-workspace.yaml

2026-03-09 09:15:40 +00:00

torrc

feat: VPS deploy script + Tor hidden service config

2026-03-08 00:29:18 +00:00

vitest.workspace.ts

test: add test infrastructure for frontend and server

2026-03-12 22:30:43 +00:00

Zaps.md

docs: Zaps.md — Lightning payment integration plan

2026-03-07 23:38:36 +00:00

S

Description

BotFights — bot competition arena with arcade fighting mode. Main repo (migrated from git.tx1138.com/lfg2025/botfight).

8.9 MiB

Languages

TypeScript 81.6%

Vue 16.7%

JavaScript 1.3%

CSS 0.2%