[ralyodio]

Anthony 2026-10-19 (bot hits decisions): sweep every site to the latest gateway;
"allow apple/google/cloudflare/bing etc. and ai chat bots".

• Verified Googlebot/bingbot/Applebot/DuckDuckBot/Cloudflare (full published
  lists, IPv4+IPv6) unmetered; the same strings from elsewhere are charged.
• ChatGPT-User/OAI-SearchBot/Perplexity (from their published addresses),
  Claude-User, Claude-SearchBot, meta-externalfetcher, meta-webindexer, YouBot,
  ExaSearchBot, AionBot: welcome, unmetered, never challenged.
• From 0.8: headless browsers, SEO resellers, stale desktop UA pools and
  Amazonbot are charged; training crawlers still pay.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​profullstack/​x402-gateway@​0.7.0 ⏵ 0.10.1	-3		+1	+1

View full report

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.

[github-actions]

ThreatCrush Security Scan

54 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 18 | LOW: 35

Severity	Rule	Location
HIGH	js-host-header-trust	packages/bots/wechat/src/index.ts:405
MEDIUM	redos-nested-quantifier	packages/actions-fleet-core/src/action-pack/schema.ts:3
MEDIUM	redos-nested-quantifier	packages/core/src/setup-helpers.ts:583
MEDIUM	sql-template-interpolation	packages/migrate/src/engines/mysql.ts:133
MEDIUM	sql-template-interpolation	packages/migrate/src/engines/postgres.ts:276
MEDIUM	sql-template-interpolation	packages/migrate/src/transforms.ts:178
MEDIUM	redos-nested-quantifier	packages/policy/src/rules/bundle-id.ts:3
MEDIUM	sql-string-concatenation	packages/targets/deploy-wordpress/src/index.ts:154
MEDIUM	redos-nested-quantifier	packages/targets/desktop-linux/src/index.ts:19
MEDIUM	redos-nested-quantifier	packages/targets/desktop-mac/src/index.ts:15
MEDIUM	redos-nested-quantifier	packages/targets/desktop-steamos/src/index.ts:28
MEDIUM	redos-nested-quantifier	packages/targets/mobile-android/src/index.ts:9
MEDIUM	redos-nested-quantifier	packages/targets/mobile-ios/src/index.ts:11
MEDIUM	redos-nested-quantifier	packages/targets/tv-androidtv/src/index.ts:14
MEDIUM	redos-nested-quantifier	packages/targets/tv-firetv/src/index.ts:13
MEDIUM	redos-nested-quantifier	packages/targets/tv-tvos/src/index.ts:14
MEDIUM	redos-nested-quantifier	packages/targets/tv-webos/src/index.ts:26
MEDIUM	js-unescaped-html-sink	sites/sh1pt.com/app/blog/[slug]/page.tsx:78
MEDIUM	js-unescaped-html-sink	sites/sh1pt.com/app/components/PitFooter.tsx:17
LOW	secret-generic-credential	packages/affiliates/skimlinks/src/index.test.ts:25
LOW	secret-generic-credential	packages/affiliates/skimlinks/src/index.test.ts:71
LOW	secret-generic-api-key	packages/affiliates/sovrn/src/index.ts:28
LOW	secret-generic-credential	packages/agent-providers/opencode/src/__tests__/opencode.test.ts:99
LOW	js-nosql-injection	packages/ai/amazon-bedrock/src/index.test.ts:121
LOW	secret-generic-credential	packages/ai/amazon-bedrock/src/index.ts:9
LOW	secret-generic-credential	packages/ai/amazon-bedrock/src/index.ts:10
LOW	secret-generic-credential	packages/ai/amazon-bedrock/src/index.ts:11
LOW	secret-generic-credential	packages/bridges/matrix/src/index.ts:58
LOW	secret-generic-credential	packages/bridges/matrix/src/index.ts:59
LOW	secret-generic-credential	packages/bridges/slack/src/index.test.ts:259
LOW	secret-generic-credential	packages/captcha/captchasolver/src/index.ts:34
LOW	secret-generic-credential	packages/cli/src/commands/secrets.ts:189
LOW	secret-generic-credential	packages/cloud/linode/src/index.ts:15
LOW	secret-generic-credential	packages/migrate/src/platforms/index.test.ts:116
LOW	secret-generic-credential	packages/observability/sentry/src/index.ts:15
LOW	secret-generic-credential	packages/outreach/producthunt/src/index.ts:103
LOW	secret-generic-credential	packages/promo/posthog/src/index.ts:23
LOW	secret-generic-credential	packages/scanners/threatcrush/test/scan-output.txt:35
LOW	secret-generic-credential	packages/scanners/threatcrush/test/scan-output.txt:40
LOW	secret-database-url	packages/scanners/threatcrush/test/scan-output.txt:54
LOW	secret-generic-credential	packages/security/snyk/src/index.ts:26
LOW	secret-generic-credential	packages/social/hashnode/src/index.ts:4
LOW	secret-generic-credential	packages/social/linkedin/src/index.ts:3
LOW	secret-generic-credential	packages/social/linkedin/src/index.ts:4
LOW	secret-generic-credential	packages/social/medium/src/index.ts:4
LOW	secret-generic-credential	packages/social/snapchat/src/index.ts:5
LOW	secret-generic-credential	packages/social/tiktok/src/index.ts:5
LOW	secret-generic-credential	packages/targets/plugin-vscode/src/index.test.ts:115
LOW	secret-generic-credential	packages/targets/registry-ans/src/index.test.ts:79
LOW	secret-generic-credential	packages/targets/registry-ans/src/index.ts:49

…and 4 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.