Compare commits
2 Commits
3d7b136cca
...
master
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
5bfec66a34 | ||
|
|
0902bfafaa |
@@ -1,25 +0,0 @@
|
||||
# Security Policy
|
||||
|
||||
## Security Audit (2026-03-25)
|
||||
|
||||
This document tracks security issues found during the 2026-03-25 audit.
|
||||
|
||||
## Fixed Issues
|
||||
|
||||
| Issue | Severity | Fixed Date | Fix |
|
||||
|-------|----------|------------|-----|
|
||||
| Telegram bot token in process command line | CRITICAL | 2026-03-25 | Switched to Python urlopen from curl subprocess |
|
||||
| HTML injection in Telegram messages | HIGH | 2026-03-25 | Added escape_html() function |
|
||||
| Insufficient --search URL encoding | MEDIUM | 2026-03-26 | Use urllib.parse.quote() |
|
||||
| --detail bounds not validated | MEDIUM | 2026-03-26 | Error on out of range |
|
||||
| No response size limits | MEDIUM | 2026-03-26 | MAX_RESPONSE_SIZE check |
|
||||
| Bare except: clauses | LOW | 2026-03-26 | Catch specific exceptions |
|
||||
| No API rate limiting | LOW | 2026-03-26 | TokenBucket rate limiter |
|
||||
|
||||
## Open Issues
|
||||
|
||||
All security issues from this audit have been addressed in subsequent releases.
|
||||
|
||||
## Reporting Security Issues
|
||||
|
||||
If you find a security vulnerability, please report it by opening an issue.
|
||||
@@ -250,35 +250,3 @@ polymarket-browse --max-total 20
|
||||
polymarket-browse --timezone UTC+8
|
||||
polymarket-browse --timezone UTC-5
|
||||
```
|
||||
|
||||
## Changelog
|
||||
|
||||
### v0.0.3 (Current)
|
||||
- Added `--starts-before` filter for filtering match events by start time
|
||||
- Added `--timezone` argument for display timezone configuration (default: UTC+7)
|
||||
- Added TokenBucket rate limiter (10 calls/sec) to prevent API overload
|
||||
- Added dynamic response size limits to prevent memory exhaustion
|
||||
- Added proper URL encoding for special characters in --search
|
||||
- Replaced bare `except:` with specific exception handling
|
||||
- Improved `--detail` argument validation with error on out-of-range
|
||||
- Added Troubleshooting, Examples sections to documentation
|
||||
- Created SECURITY.md for audit tracking
|
||||
|
||||
### v0.0.2
|
||||
- Added `--matches-only` and `--non-matches-only` filters
|
||||
- Added `--max-total` for limiting fetch size
|
||||
- Added Telegram support with `--telegram` flag
|
||||
- Improved BO2 tie detection
|
||||
|
||||
### v0.0.1
|
||||
- Initial release
|
||||
- Basic Polymarket browsing by category
|
||||
- Match/non-match market filtering
|
||||
- Moneyline odds display
|
||||
|
||||
## Credits
|
||||
|
||||
**Author:** shokollm
|
||||
**Repository:** https://github.com/shokollm/jujutsu-skills
|
||||
|
||||
Built for Hermes Agent and OpenClaw.
|
||||
|
||||
Reference in New Issue
Block a user