Found in: pre-shipment review 2026-06-30
Parent: #7
File: xbridge_mcp/http_server.py:120-144
/keys/free issues signed Ed25519 license keys with no throttling. LS_SIGNING_SECRET webhook verification is bypassed if env var is unset.
Recommendation: Add rate limiting before public launch of key infrastructure.
Found in: pre-shipment review 2026-06-30
Parent: #7
File:
xbridge_mcp/http_server.py:120-144/keys/freeissues signed Ed25519 license keys with no throttling.LS_SIGNING_SECRETwebhook verification is bypassed if env var is unset.Recommendation: Add rate limiting before public launch of key infrastructure.