mirror of
https://github.com/affaan-m/everything-claude-code.git
synced 2026-06-11 02:33:10 +08:00
The custom auth filter only rejected invalid tokens but silently passed through requests without an Authorization header, creating a complete auth bypass. Inverted the guard to reject-first: abort immediately when header is absent or malformed, then validate.