Repository navigation

fix(billing,security): verified gateway, billing and privacy defects - #52

Merged

oratis merged 12 commits into

mainfrom

fix/verified-findings-2026-08-21

Sep 7, 2026

Merged

fix(billing,security): verified gateway, billing and privacy defects#52
oratis merged 12 commits into
mainfrom
fix/verified-findings-2026-08-21

Commits on Aug 21, 2026
- fix(billing): await the credit debit before responding (F1)
  
  oratis
  and
  claude
  committed
  c6a7a59
- fix(billing): charge SSE streams when the stream ends, not at the header (F2)
  
  oratis
  and
  claude
  committed
  f345157
- fix(security): stop bucketing gateway rate limits by a spoofable client IP
  
  oratis
  and
  claude
  committed
  fc86e1e
- feat(gateway): honour ApiKey.rateLimit instead of a hard-coded 120
  
  oratis
  and
  claude
  committed
  72c5b09
- fix(billing): stop losing the PayPal top-up fee and silent post-capture failures
  
  oratis
  and
  claude
  committed
  1cc653d
- fix(security): accept CRON_SECRET only in the Authorization header
  
  oratis
  and
  claude
  committed
  11d30be
- feat(gateway): emit attributable telemetry for rejected calls (F4)
  
  oratis
  and
  claude
  committed
  d09836f
- fix(privacy): hash RequestLog client IPs and add a retention sweep (F5)
  
  oratis
  and
  claude
  committed
  e9c3ffd
- feat(health): record agent health transitions instead of only the latest value (F7)
  
  oratis
  and
  claude
  committed
  5480e78
- docs(content): stop presenting scraped ClawSkills counts as live install data (F6)
  
  oratis
  and
  claude
  committed
  21e279b
- docs(analytics): add the telemetry plan, with its refuted claims corrected
  
  oratis
  and
  claude
  committed
  96b89f5
- docs(migrations): record the production apply procedure and ordering
  
  oratis
  and
  claude
  committed
  d0b45a4

Commits

Commits on Aug 21, 2026