DorianandClaude Opus 4.6 5bf557ba6a fix: only trust proxy headers in rate-limit when TRUSTED_PROXY is set ...

X-Forwarded-For, X-Real-IP, and CF-Connecting-IP headers were
blindly trusted, allowing attackers to bypass rate limiting by
spoofing different IPs. Now only trusted when TRUSTED_PROXY env
var is configured. Falls back to Node.js socket remoteAddress.

Add tests verifying proxy headers are ignored without TRUSTED_PROXY
and respected when it is set.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-13 09:23:10 +00:00

.claude

feat: SSE live fight spectating with spectator count

2026-03-08 19:46:39 +00:00

.github/workflows

test: add test infrastructure for frontend and server

2026-03-12 22:30:43 +00:00

bot

feat: full comedy overhaul — voices, narrations, trash talk, commentary

2026-03-07 09:15:41 +00:00

docs

security: redact hidden retro combos from all public docs

2026-03-08 14:54:54 +00:00

e2e

test: E2E specs for signup, fight replay, and leaderboard flows

2026-03-13 05:15:46 +00:00

examples/python-bot

security: redact hidden retro combos from all public docs

2026-03-08 14:54:54 +00:00

frontend

chore: pin all dependency versions for reproducible builds

2026-03-13 06:21:16 +00:00

loops

feat: retro mode — arcade combo round with gamepad overlays

2026-03-08 14:13:47 +00:00

server

fix: only trust proxy headers in rate-limit when TRUSTED_PROXY is set

2026-03-13 09:23:10 +00:00

.dockerignore

test: Docker build and PWA installation verified

2026-03-09 00:38:31 +00:00

.gitignore

chore: harden .gitignore for secrets and credentials

2026-03-09 07:33:56 +00:00

BOT_SETUP.md

security: redact hidden retro combos from all public docs

2026-03-08 14:54:54 +00:00

botfights.db

feat: SSE live fight spectating with spectator count

2026-03-08 19:46:39 +00:00

BOTFIGHTS.md

fixes

2026-03-12 16:35:59 +00:00

CLAUDE.md

feat: v5 — boxing poster fight cards, 12-char names, diverse mock bots

2026-03-08 10:33:30 +00:00

deploy.sh

feat: VPS deploy script + Tor hidden service config

2026-03-08 00:29:18 +00:00

docker-compose.tor.yml

feat: VPS deploy script + Tor hidden service config

2026-03-08 00:29:18 +00:00

docker-compose.yml

fix: add cache-bust build arg to force Docker rebuild on deploy

2026-03-09 08:38:02 +00:00

Dockerfile

fix: add cache-bust build arg to force Docker rebuild on deploy

2026-03-09 08:38:02 +00:00

eslint.config.js

feat: add eslint-plugin-security rules for static analysis

2026-03-13 05:26:10 +00:00

nostr-login-implementation.md

chore: add PromptDifficulty type and nostr login planning doc

2026-03-09 14:26:43 +00:00

package.json

chore: pin all dependency versions for reproducible builds

2026-03-13 06:21:16 +00:00

PLAN.md

feat: betting system — Cashu escrow, Lightning deposit/withdraw, payouts

2026-03-08 00:33:08 +00:00

pnpm-lock.yaml

chore: pin all dependency versions for reproducible builds

2026-03-13 06:21:16 +00:00

pnpm-workspace.yaml

fix: move dependency overrides to pnpm-workspace.yaml

2026-03-09 09:15:40 +00:00

torrc

feat: VPS deploy script + Tor hidden service config

2026-03-08 00:29:18 +00:00

vitest.workspace.ts

test: add test infrastructure for frontend and server

2026-03-12 22:30:43 +00:00

Zaps.md

docs: Zaps.md — Lightning payment integration plan

2026-03-07 23:38:36 +00:00

S

Description

BotFights — bot competition arena with arcade fighting mode. Main repo (migrated from git.tx1138.com/lfg2025/botfight).

8.9 MiB

Languages

TypeScript 81.6%

Vue 16.7%

JavaScript 1.3%

CSS 0.2%