foxyzandClaude Opus 5.5 e2301aa4ec Server hardening: finite numbers, open servers, unkickable host, no URL leaks ...

- Reject non-finite numerics at protocol parse and in the engine
  (a 1e400 seek became Infinity and broke every broadcast).
- Reject empty swaps; sanitize URL-looking media names.
- Blank password = open server; defaults no longer 'change-me'.
- Loopback peers (the in-process host) can't be kicked.
- /health no longer exposes media/transport; file URLs use the
  host the client dialled instead of 127.0.0.1.
- Count served bytes as streamed, not as requested.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-07 00:30:12 +03:00

..

src

Server hardening: finite numbers, open servers, unkickable host, no URL leaks

2026-10-07 00:30:12 +03:00

server.dart

Initial commit: watch-together phases 0-4 + presence hardening, internet-tested

2026-09-12 00:13:43 +03:00